# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=395 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 396 --- ## [Ruby snippet to iterate through array results in error "Ruby exception occurred: undefined method \`\[\]' for #\\`"](https://discuss.elastic.co/t/ruby-snippet-to-iterate-through-array-results-in-error-ruby-exception-occurred-undefined-method-for-logstash-0x69068bc1/222166)
**Author:** [@kaj](https://discuss.elastic.co/u/kaj)\ **Replies:** 4\ **Last updated:** [March 5, 2020, 12:56am UTC](https://discuss.elastic.co/t/ruby-snippet-to-iterate-through-array-results-in-error-ruby-exception-occurred-undefined-method-for-logstash-0x69068bc1/222166 "2020-03-05T00:56:25Z")
I've got the following xpath: xpath =\> \[ "/record/parameters/parameter/text()", "parameter" \] Parameter is a field that can have a variable number of values, from 0 to n. So it can not exist, or it can have n v… --- ## [Extracting filename from log.file.path not working](https://discuss.elastic.co/t/extracting-filename-from-log-file-path-not-working/222156)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 8\ **Last updated:** [March 5, 2020, 12:38am UTC](https://discuss.elastic.co/t/extracting-filename-from-log-file-path-not-working/222156 "2020-03-05T00:38:44Z")
I am trying to extract filename from log.file.path and then apply grok filter based on those as shown below. But the filename isnt being extracted. How can I extract the name and use the name to apply filters on? filter… --- ## [Can someone explain how these time functions work?](https://discuss.elastic.co/t/can-someone-explain-how-these-time-functions-work/222168)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 10:13pm UTC](https://discuss.elastic.co/t/can-someone-explain-how-these-time-functions-work/222168 "2020-03-04T22:13:13Z")
This is confusing me and I just want to understand how this all works: I have two new fields called @SMF\_TIMESTAMP and @split\_time. SMF\_TIMESTAMP I convert to my timezone per the code below. And split\_time I set to UTC… --- ## [How to covert 04-Mar-2020 19:20:06 o'clock GMT using Date Filter](https://discuss.elastic.co/t/how-to-covert-04-mar-2020-1906-oclock-gmt-using-date-filter/222158)
**Author:** [@keshavl](https://discuss.elastic.co/u/keshavl)\ **Replies:** 2\ **Last updated:** [March 4, 2020, 10:12pm UTC](https://discuss.elastic.co/t/how-to-covert-04-mar-2020-1906-oclock-gmt-using-date-filter/222158 "2020-03-04T22:12:39Z")
HI, I have an Weblogic Server which populates logs and date within logs is in format as "04-Mar-2020 19:20:06 o'clock GMT". What format should I use to covert this String into @Timestamp using DATE filter of logstash… --- ## [Logstash redis filter goes wrong](https://discuss.elastic.co/t/logstash-redis-filter-goes-wrong/222151)
**Author:** [@TheBigPack](https://discuss.elastic.co/u/TheBigPack)\ **Replies:** 1\ **Last updated:** [March 4, 2020, 9:22pm UTC](https://discuss.elastic.co/t/logstash-redis-filter-goes-wrong/222151 "2020-03-04T21:22:28Z")
Hello, everybody, i have the following error messages in the plain-logstash.log Ruby exception occurred: undefined method \`\[ \]' for #LogStash::Event:0x671fe060 The filter that causes this problem looks like this fil… --- ## [Logstash deadletter queue vs persistent queue](https://discuss.elastic.co/t/logstash-deadletter-queue-vs-persistent-queue/222161)
**Author:** [@raghuveera](https://discuss.elastic.co/u/raghuveera)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 9:09pm UTC](https://discuss.elastic.co/t/logstash-deadletter-queue-vs-persistent-queue/222161 "2020-03-04T21:09:50Z")
Hi, If we enable persistent queue in logstash. Does, it disable dead letter queue? I have logstash with dead letter queue enabled and receiving log files. Once, i enabled persistent queue the dead letter queue stopped … --- ## [CSV Reader using LogStash. Unable to Read CSV](https://discuss.elastic.co/t/csv-reader-using-logstash-unable-to-read-csv/221491)
**Author:** [@keshavl](https://discuss.elastic.co/u/keshavl)\ **Replies:** 4\ **Last updated:** [March 4, 2020, 8:38pm UTC](https://discuss.elastic.co/t/csv-reader-using-logstash-unable-to-read-csv/221491 "2020-03-04T20:38:39Z")
HI All, I am trying to read CSV files and below is my logstash configuration. I am new to it hence I have just kept it simple as below. Error I face after starting logstash is --- ## [When should we set pipeline.workers to 1?](https://discuss.elastic.co/t/when-should-we-set-pipeline-workers-to-1/222072)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 7\ **Last updated:** [March 4, 2020, 6:45pm UTC](https://discuss.elastic.co/t/when-should-we-set-pipeline-workers-to-1/222072 "2020-03-04T18:45:55Z")
Hi, I have read (but cant find where and what) that in some conditions pipeline.workers should be set to 1 or else the information is not processed in the right order. My configuration in conf.d is to have several file… --- ## [JDBC input filter balancing](https://discuss.elastic.co/t/jdbc-input-filter-balancing/222105)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [March 4, 2020, 6:24pm UTC](https://discuss.elastic.co/t/jdbc-input-filter-balancing/222105 "2020-03-04T18:24:49Z")
Hi, can I have 3 different LS instances (1 on node1, 1 on node2, 1 on node3) that should use the standand JDBC input filter. is there a way to balance the usage of them of each node? I mean, if node1 extract a subset of… --- ## [How to make command line -e working in linux, this is basic](https://discuss.elastic.co/t/how-to-make-command-line-e-working-in-linux-this-is-basic/222115)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 6:19pm UTC](https://discuss.elastic.co/t/how-to-make-command-line-e-working-in-linux-this-is-basic/222115 "2020-03-04T18:19:49Z")
Hi All I have a conf file, below is the example When i run this in linux machine with a .conf file file, it work perfectly with command line -f \` .logstash --debug -f test.conf \` below is the conf file \> input {… --- ## [Use gsub to add points to an integer](https://discuss.elastic.co/t/use-gsub-to-add-points-to-an-integer/221901)
**Author:** [@opellulo](https://discuss.elastic.co/u/opellulo)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 6:17pm UTC](https://discuss.elastic.co/t/use-gsub-to-add-points-to-an-integer/221901 "2020-03-04T18:17:07Z")
Hi all, In my data stream i have a "price" value that however is an integer (1399 for 13.99 and so on). I want to convert it to ease the visualization but i can't find any valid numeral.js option in Kibana so i though o… --- ## [Dead letter queue log files questions](https://discuss.elastic.co/t/dead-letter-queue-log-files-questions/222134)
**Author:** [@raghuveera](https://discuss.elastic.co/u/raghuveera)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 5:54pm UTC](https://discuss.elastic.co/t/dead-letter-queue-log-files-questions/222134 "2020-03-04T17:54:41Z")
Hi I am using dead letter queue with logstash and i see various empty log files like .log in /var/log/logstash/deadletter folder. Why are the log files empty ? Does it mean that events are processed successfully ? Whe… --- ## [Data\_points is mandatory, what is the syntaxe to pass fields to influxDB](https://discuss.elastic.co/t/data-points-is-mandatory-what-is-the-syntaxe-to-pass-fields-to-influxdb/222132)
**Author:** [@jeanflorentine](https://discuss.elastic.co/u/jeanflorentine)\ **Replies:** 1\ **Last updated:** [March 4, 2020, 5:27pm UTC](https://discuss.elastic.co/t/data-points-is-mandatory-what-is-the-syntaxe-to-pass-fields-to-influxdb/222132 "2020-03-04T17:27:48Z")
Cannot find the syntax to get the fields passed to influxDB my K8S message I got through Kafka input end like (of course each message has different values: "fields":{"env":"caa-hors-prod","cluster\_name":"hprd","client"… --- ## [Conditional inside filter error](https://discuss.elastic.co/t/conditional-inside-filter-error/222101)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 4:58pm UTC](https://discuss.elastic.co/t/conditional-inside-filter-error/222101 "2020-03-04T16:58:23Z")
Hi, im trying to parse a field only if its a number, from time to time I get the string "n/a" instead of a number so I write this conditional inside a filter, but doesnt work. I also have another mutate { convert =\> {}… --- ## [Logstash Mutate add\_field geo\_point](https://discuss.elastic.co/t/logstash-mutate-add-field-geo-point/222103)
**Author:** [@kevvo2000](https://discuss.elastic.co/u/kevvo2000)\ **Replies:** 1\ **Last updated:** [March 4, 2020, 4:35pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-geo-point/222103 "2020-03-04T16:35:56Z")
I am having an issue getting geo\_point data into Kibana from a Security Appliance Here is my logstash .conf file mutate { add\_field =\> { "\[location\]\[lat\]" =\> "%{\[geoip\]\[latitude\]}" } add\_field =\> { "\[location\]\[lon\]" … --- ## [Ruby exception error on logstash](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 6\ **Last updated:** [March 4, 2020, 2:29pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944 "2020-03-04T14:29:24Z")
Hi, im formating a date string with the following code. ruby { code =\> ' time = event.get("fecha") event.remove("fecha") … --- ## [Pipelines.yml pipeline to pipeline address unavailable error again!](https://discuss.elastic.co/t/pipelines-yml-pipeline-to-pipeline-address-unavailable-error-again/221954)
**Author:** [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 2:28pm UTC](https://discuss.elastic.co/t/pipelines-yml-pipeline-to-pipeline-address-unavailable-error-again/221954 "2020-03-04T14:28:44Z")
Hi. I don't understand why my multipiplines don't work while it should as I've created config files by an example. I've tried to restart Logstash as it was using a single-file pipeline (using -f flag). Logstash is a cont… --- ## [Logstash scalability and Input plugins](https://discuss.elastic.co/t/logstash-scalability-and-input-plugins/221950)
**Author:** [@faridNR](https://discuss.elastic.co/u/faridNR)\ **Replies:** 2\ **Last updated:** [March 4, 2020, 2:16pm UTC](https://discuss.elastic.co/t/logstash-scalability-and-input-plugins/221950 "2020-03-04T14:16:05Z")
It’s feasible to setup a Logstash cluster model either by ruing multiple services or hosting Logstash image in a cluster like kubernetes, however with certain Input Plugins where you pull-in/query data you will run into… --- ## [Logstash 7.6 how to create geo\_point field](https://discuss.elastic.co/t/logstash-7-6-how-to-create-geo-point-field/221931)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 12:30pm UTC](https://discuss.elastic.co/t/logstash-7-6-how-to-create-geo-point-field/221931 "2020-03-04T12:30:52Z")
Hello, I am using the geoip filter in order to do some geoip lookup and I would like to be able to use the kibana 7.6 maps to get data into the maps. The geoip lookup seam to be working however there is no geo\_point typ… --- ## [Trying to filter output from logstash](https://discuss.elastic.co/t/trying-to-filter-output-from-logstash/222070)
**Author:** [@tobbes](https://discuss.elastic.co/u/tobbes)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 12:11pm UTC](https://discuss.elastic.co/t/trying-to-filter-output-from-logstash/222070 "2020-03-04T12:11:09Z")
I am running logstash as part of an elk cluster on kubernetes. I have set it up using helm on minikube with docker as vm-engine. I am trying to add a filter to drop some of the events from logstash. I have the followi… --- ## [Help! logstash conf filter add\_tag not working](https://discuss.elastic.co/t/help-logstash-conf-filter-add-tag-not-working/221582)
**Author:** [@elady](https://discuss.elastic.co/u/elady)\ **Replies:** 4\ **Last updated:** [March 4, 2020, 11:55am UTC](https://discuss.elastic.co/t/help-logstash-conf-filter-add-tag-not-working/221582 "2020-03-04T11:55:51Z")
Hey all. This is my first post in these forums, so- hey everyone :slight\_smile: I am parsing few different input file sources using grok filters. if there is no match on any of them I have created a "fail safe" while … --- ## [Cannot find the correct InfluxDB output lugin Config to avoid HTTP 400 error on the InfluxDB](https://discuss.elastic.co/t/cannot-find-the-correct-influxdb-output-lugin-config-to-avoid-http-400-error-on-the-influxdb/222043)
**Author:** [@jeanflorentine](https://discuss.elastic.co/u/jeanflorentine)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 10:47am UTC](https://discuss.elastic.co/t/cannot-find-the-correct-influxdb-output-lugin-config-to-avoid-http-400-error-on-the-influxdb/222043 "2020-03-04T10:47:03Z")
logstash.conf input { kafka { ... } } filter { json { source =\> "message" } } output { influxdb { id =\> "influxdb080" db =\> "AMERXX01" user =\> "urxk1me1" password =\> "HA6H67yjHcp6XiX4" … --- ## [Need help logstash-input-salesforce](https://discuss.elastic.co/t/need-help-logstash-input-salesforce/222028)
**Author:** [@bittusingh](https://discuss.elastic.co/u/bittusingh)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 9:45am UTC](https://discuss.elastic.co/t/need-help-logstash-input-salesforce/222028 "2020-03-04T09:45:38Z")
Hi All, I have usecase to retrieve data from salesforce SDFS which can be done using logstash-input-salesforce. But, when trying to install the plugin it is throwing error Validating logstash-input-salesforce Install… --- ## [Can i send different Logs to different Indicies?](https://discuss.elastic.co/t/can-i-send-different-logs-to-different-indicies/222027)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 9:37am UTC](https://discuss.elastic.co/t/can-i-send-different-logs-to-different-indicies/222027 "2020-03-04T09:37:02Z")
Hello Community, by now, my config file for incoming Logs looks like this: input { udp { port =\> 5140 type =\> syslog } } filter { syslog\_pri { } date { match =\> \[ "syslog\_timestamp", "MMM d HH:m… --- ## [Multiple Output Sections to the same Elastic-Cluster](https://discuss.elastic.co/t/multiple-output-sections-to-the-same-elastic-cluster/222002)
**Author:** [@danieln](https://discuss.elastic.co/u/danieln)\ **Replies:** 1\ **Last updated:** [March 4, 2020, 8:14am UTC](https://discuss.elastic.co/t/multiple-output-sections-to-the-same-elastic-cluster/222002 "2020-03-04T08:14:56Z")
Hallo Community, we are actually using logstash with a quite big pipeline for all data send from filebeat. All data goes through the pipeline and then there are multiple output sections which send the data to different … --- ## [Link logstash-filter to ruby gem](https://discuss.elastic.co/t/link-logstash-filter-to-ruby-gem/222000)
**Author:** [@GaryChewter](https://discuss.elastic.co/u/GaryChewter)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 7:58am UTC](https://discuss.elastic.co/t/link-logstash-filter-to-ruby-gem/222000 "2020-03-04T07:58:16Z")
I want to create a logstash filter plugin that make use the function from a ruby gem library. Any ways to use a ruby gem library in logstash filter plugin? --- ## [Sequel::DatabaseConnectionError](https://discuss.elastic.co/t/sequel-databaseconnectionerror/221882)
**Author:** [@Raguvarthan](https://discuss.elastic.co/u/Raguvarthan)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 5:53am UTC](https://discuss.elastic.co/t/sequel-databaseconnectionerror/221882 "2020-03-04T05:53:45Z")
I am trying to configure my SQL server with elastic search using logstash. I have completed configuring elastic search and logstash. But when I trigger logstash.bat to connect my pipeline file below is the error captured… --- ## [Unable to read files in persistent queue for logstash](https://discuss.elastic.co/t/unable-to-read-files-in-persistent-queue-for-logstash/221935)
**Author:** [@raghuveera](https://discuss.elastic.co/u/raghuveera)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 3:36am UTC](https://discuss.elastic.co/t/unable-to-read-files-in-persistent-queue-for-logstash/221935 "2020-03-04T03:36:11Z")
I have recently enabled persistent queue configuration for logstash. I do see some files in location /var/lib/logstash/queue/\/, named as checkpoint.head and page.50. But, when i try to cat and read the file… --- ## [Logstash config file issues](https://discuss.elastic.co/t/logstash-config-file-issues/221977)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 3:30am UTC](https://discuss.elastic.co/t/logstash-config-file-issues/221977 "2020-03-04T03:30:05Z")
Hi All, i have doubts on below two queries. I have 2 linux servers where the filebeat was installed . i want to configure the each server to connect to logstash config seperately. ie. one server should read one logst… --- ## [Logstash 7.6.0 wrong @timestamp](https://discuss.elastic.co/t/logstash-7-6-0-wrong-timestamp/221960)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 1\ **Last updated:** [March 4, 2020, 1:22am UTC](https://discuss.elastic.co/t/logstash-7-6-0-wrong-timestamp/221960 "2020-03-04T01:22:58Z")
Hi all, I've been shipping data from winlogbeat to logstash to es and the @timestamp field is not showing the correct timezone The server is in GMT+11 and the date is correct as you can see below (Mar 4 11:04:01) I'm … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=394) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=396)