# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=391 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 392 --- ## [Logstash if condition regex](https://discuss.elastic.co/t/logstash-if-condition-regex/223141)
**Author:** [@ash2](https://discuss.elastic.co/u/ash2)\ **Replies:** 4\ **Last updated:** [March 11, 2020, 8:00pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex/223141 "2020-03-11T20:00:29Z")
I want to write an if condition which takes regex for file path of window directory in logstash. Please help me with the regex pattern of C:\\Windows\\System32\\logs\\\*.log . e.g. output{ if \[log\]\[file\]\[path\] =~ /C:\\Windo… --- ## [Mapper parsing exeption logstash](https://discuss.elastic.co/t/mapper-parsing-exeption-logstash/223108)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 3\ **Last updated:** [March 11, 2020, 7:50pm UTC](https://discuss.elastic.co/t/mapper-parsing-exeption-logstash/223108 "2020-03-11T19:50:47Z")
Hi I am receiving this error message. I have been searching for hours where the problem is but I cannot find it. Is there a method to finding exactly where the problem is occurring? Mär 11 12:21:16 mon logstash\[16980\]… --- ## [Logstash-oss api](https://discuss.elastic.co/t/logstash-oss-api/223205)
**Author:** [@Ilya\_Moskalev](https://discuss.elastic.co/u/Ilya_Moskalev)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 7:31pm UTC](https://discuss.elastic.co/t/logstash-oss-api/223205 "2020-03-11T19:31:37Z")
Hello! tell me trying to get the logstash-oss parameters through api but swears when prompted, maybe api does not work on logstash-oss curl -XGET 'localhost:9600/?pretty' 404 Not FoundNo context found for request --- ## [Having 4 independent pipelines vs pipeline-to-pipeline communication](https://discuss.elastic.co/t/having-4-independent-pipelines-vs-pipeline-to-pipeline-communication/222513)
**Author:** [@Eugene\_Dvorkin1](https://discuss.elastic.co/u/Eugene_Dvorkin1)\ **Replies:** 2\ **Last updated:** [March 11, 2020, 6:32pm UTC](https://discuss.elastic.co/t/having-4-independent-pipelines-vs-pipeline-to-pipeline-communication/222513 "2020-03-11T18:32:37Z")
I have 4 pipelines because I have to send data to different destinations: for example, prod and nonprod elastic search cluster, s3 bucket and some custom endpoint. Of course, I can configure one pipeline with different o… --- ## [Parsing XML File -\> xpath does not parse all fields in "event\_data"](https://discuss.elastic.co/t/parsing-xml-file-xpath-does-not-parse-all-fields-in-event-data/222916)
**Author:** [@jmohar](https://discuss.elastic.co/u/jmohar)\ **Replies:** 3\ **Last updated:** [March 11, 2020, 5:13pm UTC](https://discuss.elastic.co/t/parsing-xml-file-xpath-does-not-parse-all-fields-in-event-data/222916 "2020-03-11T17:13:58Z")
Hello ! After hours of trying i can´t find "the light". I have the following customized Windows XML File... with data in \[messages\]...but xpath only recognize the first field (activity\_id) ...and does not parse the "Use… --- ## [Jenkins junit results to logstash](https://discuss.elastic.co/t/jenkins-junit-results-to-logstash/223182)
**Author:** [@Svs](https://discuss.elastic.co/u/Svs)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 4:35pm UTC](https://discuss.elastic.co/t/jenkins-junit-results-to-logstash/223182 "2020-03-11T16:35:15Z")
I have jenkins logstash plugin installed. I have it writing the console log to elasticSearch(ES). But I need the individual test results saved. I have a file with the results in junit format. // junit "logs/results.x… --- ## [Strange behaviour kv field\_split](https://discuss.elastic.co/t/strange-behaviour-kv-field-split/219234)
**Author:** [@Fred3](https://discuss.elastic.co/u/Fred3)\ **Replies:** 4\ **Last updated:** [March 11, 2020, 4:21pm UTC](https://discuss.elastic.co/t/strange-behaviour-kv-field-split/219234 "2020-03-11T16:21:09Z")
Hi All, I'm trying to parse a log with the character "|" as split field value. It works fine for all fields but I get extra fields which are really broken and consists of multiple field-value-pairs, e.g. 01-01015173|… --- ## [Logstash - What happen if logstash can't contact elasticsearch node](https://discuss.elastic.co/t/logstash-what-happen-if-logstash-cant-contact-elasticsearch-node/222474)
**Author:** [@pjo](https://discuss.elastic.co/u/pjo)\ **Replies:** 1\ **Last updated:** [March 11, 2020, 3:56pm UTC](https://discuss.elastic.co/t/logstash-what-happen-if-logstash-cant-contact-elasticsearch-node/222474 "2020-03-11T15:56:09Z")
Hello, I'm new on this product To test product, i have following setup : Filebeat installed on every hosts i need to send/gather logs Standalone logstash servers that received logs from filebeats Elasticsearch and Ki… --- ## [SinceDB null, question](https://discuss.elastic.co/t/sincedb-null-question/223169)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 2\ **Last updated:** [March 11, 2020, 3:39pm UTC](https://discuss.elastic.co/t/sincedb-null-question/223169 "2020-03-11T15:39:04Z")
If I set sincedb\_path = /dev/null in a logstash configuration, that means that every time I run logstash, de data will be re-indexed in elastic? this will create duplicates? what problems could arise with this? --- ## [Dissect filter - Empty data between delimiter: unexpected behavior](https://discuss.elastic.co/t/dissect-filter-empty-data-between-delimiter-unexpected-behavior/223171)
**Author:** [@tvdruenen](https://discuss.elastic.co/u/tvdruenen)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 3:31pm UTC](https://discuss.elastic.co/t/dissect-filter-empty-data-between-delimiter-unexpected-behavior/223171 "2020-03-11T15:31:59Z")
https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html#\_empty\_data\_between\_delimiters I have the following dissect config: if "log" in \[tags\] { dissect { mapping =\> { "message" =\> "%{… --- ## [Logstash -incremental data](https://discuss.elastic.co/t/logstash-incremental-data/222888)
**Author:** [@chelseia](https://discuss.elastic.co/u/chelseia)\ **Replies:** 3\ **Last updated:** [March 11, 2020, 3:20pm UTC](https://discuss.elastic.co/t/logstash-incremental-data/222888 "2020-03-11T15:20:57Z")
I have to ingest the new records which are all update din database.I dont have sorted column to use last\_sql\_value and also timestamp column.so how can i ingest the incremental data --- ## [Elasticsearch filter - Search previous days index](https://discuss.elastic.co/t/elasticsearch-filter-search-previous-days-index/223140)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 1\ **Last updated:** [March 11, 2020, 2:46pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-search-previous-days-index/223140 "2020-03-11T14:46:07Z")
Currently I use the elasticsearch filter to search for specific events that have occurred. The index I am searching is index =\> "filebeat-\*-%{+y}.%{+MM}.%{+dd}" I'm looking to query both today's index and also yesterda… --- ## [Store temporary variable](https://discuss.elastic.co/t/store-temporary-variable/222978)
**Author:** [@hederi](https://discuss.elastic.co/u/hederi)\ **Replies:** 2\ **Last updated:** [March 11, 2020, 9:37am UTC](https://discuss.elastic.co/t/store-temporary-variable/222978 "2020-03-11T09:37:51Z")
Hi, I'm parsing a log file (flexlm debug.log) and I need to combine 2 fields from different lines. Basically, I need to extract the date (Mon Mar 09 2020) and add it to the timestamp that appear in each line, for exam… --- ## [What is puma configuration for logstash 7.4?](https://discuss.elastic.co/t/what-is-puma-configuration-for-logstash-7-4/223137)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 12:58pm UTC](https://discuss.elastic.co/t/what-is-puma-configuration-for-logstash-7-4/223137 "2020-03-11T12:58:23Z")
Hi, I am using logstash 7.4. please let me know, what puma configuration can we use for running logstash? Thanks, --- ## [Not able to process binary data (coming from kafka) in logstash custom ruby filter](https://discuss.elastic.co/t/not-able-to-process-binary-data-coming-from-kafka-in-logstash-custom-ruby-filter/223130)
**Author:** [@hits.elastic](https://discuss.elastic.co/u/hits.elastic)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 12:39pm UTC](https://discuss.elastic.co/t/not-able-to-process-binary-data-coming-from-kafka-in-logstash-custom-ruby-filter/223130 "2020-03-11T12:39:45Z")
Hi, I have created a logstash custom ruby filter to decode data coming from kafka queue. Below is my code snippet of ruby. Here I am calling java method "@decoderObj.decodeData" to decode the data. public def regi… --- ## [Query ElasticSeach with Conf Logstash](https://discuss.elastic.co/t/query-elasticseach-with-conf-logstash/223101)
**Author:** [@brunojpsantos](https://discuss.elastic.co/u/brunojpsantos)\ **Replies:** 5\ **Last updated:** [March 11, 2020, 11:42am UTC](https://discuss.elastic.co/t/query-elasticseach-with-conf-logstash/223101 "2020-03-11T11:42:12Z")
Hi, I want to use a pipeline to do a query in elasticsearch and replace just some fields from csv input file. I have this fields in elasticsearch: ID, State And I want to replace the field State with CSV file Anyone … --- ## [How to setup multiple config file in logstash](https://discuss.elastic.co/t/how-to-setup-multiple-config-file-in-logstash/223059)
**Author:** [@malleshrp](https://discuss.elastic.co/u/malleshrp)\ **Replies:** 2\ **Last updated:** [March 11, 2020, 11:09am UTC](https://discuss.elastic.co/t/how-to-setup-multiple-config-file-in-logstash/223059 "2020-03-11T11:09:13Z")
I want to setup multiple config files in logstash.. currently running individual .conf files which will transfer data from mysql to elasticsearch. I am having 90 files how do I setup in one config file for production … --- ## [Parse json data into elasticsearch](https://discuss.elastic.co/t/parse-json-data-into-elasticsearch/222918)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 1\ **Last updated:** [March 11, 2020, 10:58am UTC](https://discuss.elastic.co/t/parse-json-data-into-elasticsearch/222918 "2020-03-11T10:58:58Z")
I have this json downloaded from a website: \[ { "data": "2020-02-24 21:00:00", "stato": "ITA", "codice\_regione": 13, … --- ## [Normalise and parse xml encoded tag element correctly](https://discuss.elastic.co/t/normalise-and-parse-xml-encoded-tag-element-correctly/222493)
**Author:** [@guntutur](https://discuss.elastic.co/u/guntutur)\ **Replies:** 2\ **Last updated:** [March 11, 2020, 10:02am UTC](https://discuss.elastic.co/t/normalise-and-parse-xml-encoded-tag-element-correctly/222493 "2020-03-11T10:02:20Z")
Hi All I'm getting started with using elk stack, i need to configure logstash to be able to parse this logfile correctly, the sample data is something like this : ####\ \<\> \<\> \<1583509061697\> … --- ## [\[SOLVED\]\[LOGSTASH-FILTER-RUBY\] Import class 'date'](https://discuss.elastic.co/t/solved-logstash-filter-ruby-import-class-date/223078)
**Author:** [@Bruno1](https://discuss.elastic.co/u/Bruno1)\ **Replies:** 1\ **Last updated:** [March 11, 2020, 9:41am UTC](https://discuss.elastic.co/t/solved-logstash-filter-ruby-import-class-date/223078 "2020-03-11T09:41:08Z")
Hello I have the following error when I try to import 'date' library on ruby logstash filter. \[2020-03-11T09:09:01,916\]\[ERROR\]\[logstash.filters.ruby \]\[main\] Ruby exception occurred: cannot load Java class date My … --- ## [Netflow to Cloud Service](https://discuss.elastic.co/t/netflow-to-cloud-service/221352)
**Author:** [@anggara88](https://discuss.elastic.co/u/anggara88)\ **Replies:** 5\ **Last updated:** [March 11, 2020, 9:27am UTC](https://discuss.elastic.co/t/netflow-to-cloud-service/221352 "2020-03-11T09:27:39Z")
Hello good people, can you tell me, how to send my netflow data to elasticsearch cloud service ? in my local service, I use elastiflow to get netflow data is there a documentation to send elastiflow to cloud service ? … --- ## [Parse array of json having json and array in it](https://discuss.elastic.co/t/parse-array-of-json-having-json-and-array-in-it/222936)
**Author:** [@sandy1139](https://discuss.elastic.co/u/sandy1139)\ **Replies:** 1\ **Last updated:** [March 10, 2020, 2:20pm UTC](https://discuss.elastic.co/t/parse-array-of-json-having-json-and-array-in-it/222936 "2020-03-10T14:20:00Z")
I have the following message which is JSON Array. It has nested JSON object and an Array within, how would I parse this. --- ## [Last\_run\_metadata\_path](https://discuss.elastic.co/t/last-run-metadata-path/223075)
**Author:** [@chelseia](https://discuss.elastic.co/u/chelseia)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 8:59am UTC](https://discuss.elastic.co/t/last-run-metadata-path/223075 "2020-03-11T08:59:16Z")
how to fetch the last\_run\_metadata\_path for logstash configuration? --- ## [Can't rename a field to user.name](https://discuss.elastic.co/t/cant-rename-a-field-to-user-name/222395)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 5\ **Last updated:** [March 11, 2020, 7:52am UTC](https://discuss.elastic.co/t/cant-rename-a-field-to-user-name/222395 "2020-03-11T07:52:05Z")
I'm trying to rename user fields from several different sources to user.name to match ECS but none will work. If I leave it as user then the field shows up but when I try to rename it to user.name, I see all the other fi… --- ## [Problem java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/problem-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/223051)
**Author:** [@Tnahsoe](https://discuss.elastic.co/u/Tnahsoe)\ **Replies:** 1\ **Last updated:** [March 11, 2020, 6:42am UTC](https://discuss.elastic.co/t/problem-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/223051 "2020-03-11T06:42:55Z")
When I try to start logstash using /usr/share/logstash$ bin/logstash -e 'input{stdin{}}output{stdout{}}' it gives OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will like… --- ## [Logstash Records are getting skipped from filter](https://discuss.elastic.co/t/logstash-records-are-getting-skipped-from-filter/223037)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 2:45am UTC](https://discuss.elastic.co/t/logstash-records-are-getting-skipped-from-filter/223037 "2020-03-11T02:45:26Z")
Hello Team, We are using combination grok, ruby ,date filters in our Logstash pipeline. and the input load is is around 20k records per minute. We observed that sometimes the data which is not present in that record … --- ## [Generate UUID of the String(field) in logstash](https://discuss.elastic.co/t/generate-uuid-of-the-string-field-in-logstash/222943)
**Author:** [@Pink11](https://discuss.elastic.co/u/Pink11)\ **Replies:** 4\ **Last updated:** [March 10, 2020, 9:43pm UTC](https://discuss.elastic.co/t/generate-uuid-of-the-string-field-in-logstash/222943 "2020-03-10T21:43:42Z")
want to generate consistent UUID(Just like MD5) of the String(field) in logstash. Tried Using fingerprint with UUID but it gives random UUID. --- ## [Date format Feb 21, 2020 7:52:15 PM, in logstash](https://discuss.elastic.co/t/date-format-feb-21-2020-715-pm-in-logstash/222945)
**Author:** [@Pink11](https://discuss.elastic.co/u/Pink11)\ **Replies:** 2\ **Last updated:** [March 10, 2020, 8:15pm UTC](https://discuss.elastic.co/t/date-format-feb-21-2020-715-pm-in-logstash/222945 "2020-03-10T20:15:15Z")
want to format date in "Feb 21, 2020 7:52:15 PM", format What I have "zonedTime": "2020-02-21T19:52:15.001Z", and UNIX epoch as input --- ## [COLLECTd--\>LOGSTASH---\>GRAPHITE](https://discuss.elastic.co/t/collectd-logstash-graphite/223004)
**Author:** [@Narayana](https://discuss.elastic.co/u/Narayana)\ **Replies:** 0\ **Last updated:** [March 10, 2020, 7:11pm UTC](https://discuss.elastic.co/t/collectd-logstash-graphite/223004 "2020-03-10T19:11:34Z")
Dear All, Can you help me with logstash configuration to send the data to graphite. I have successfully send the metrics from collectd to graphite with out any issues but the same is not possible when i trying with LOG… --- ## [Basic logstash as restful endpoint example](https://discuss.elastic.co/t/basic-logstash-as-restful-endpoint-example/222998)
**Author:** [@smugsmugsmug](https://discuss.elastic.co/u/smugsmugsmug)\ **Replies:** 0\ **Last updated:** [March 10, 2020, 6:42pm UTC](https://discuss.elastic.co/t/basic-logstash-as-restful-endpoint-example/222998 "2020-03-10T18:42:14Z")
I'm trying to set up logstash to be a simple restful endpoint that forwards log messages to indexes within my elastic search instance. I wasn't really able to get a clear idea of how to do this from reading the "getting … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=390) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=392)