# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=401 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 402 --- ## [Does Dissect's mapping able to match multiple pattern?](https://discuss.elastic.co/t/does-dissects-mapping-able-to-match-multiple-pattern/220259)
**Author:** [@Muhammad\_Ariful\_Isla](https://discuss.elastic.co/u/Muhammad_Ariful_Isla)\ **Replies:** 1\ **Last updated:** [February 21, 2020, 3:15pm UTC](https://discuss.elastic.co/t/does-dissects-mapping-able-to-match-multiple-pattern/220259 "2020-02-21T15:15:57Z")
As my log have multiple pattern I need to use multiple dissect pattern so that if one pattern fails to recognize the log other can capture. Following pseudo configuration works, "message" =\> "pattern1" Or "message" =\> … --- ## [Event parsing - perf\_data from cmkbeat](https://discuss.elastic.co/t/event-parsing-perf-data-from-cmkbeat/220001)
**Author:** [@Robo](https://discuss.elastic.co/u/Robo)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 2:03pm UTC](https://discuss.elastic.co/t/event-parsing-perf-data-from-cmkbeat/220001 "2020-02-21T14:03:24Z")
Hello, We are collecting some server metric using cmkbeat agent. The output is available in following format: perf\_data: heap=8308.406693;15045.98125;15837.875;;15837.875 nonheap=582.264664;0;0;;0 perf\_data: generic\_… --- ## [Set and persist elasticsearch index mappings for couchdb\_changes input from logstash](https://discuss.elastic.co/t/set-and-persist-elasticsearch-index-mappings-for-couchdb-changes-input-from-logstash/220357)
**Author:** [@omunyari](https://discuss.elastic.co/u/omunyari)\ **Replies:** 0\ **Last updated:** [February 21, 2020, 12:37pm UTC](https://discuss.elastic.co/t/set-and-persist-elasticsearch-index-mappings-for-couchdb-changes-input-from-logstash/220357 "2020-02-21T12:37:11Z")
I am currently populating an elasticsearch index from logstash using the couchdb\_changes input plugin with the following configuration. input { couchdb\_changes { type =\> "meet" db =\> "my\_db" host =\> "127.0.0.1" por… --- ## [Transfer json file to multiple document](https://discuss.elastic.co/t/transfer-json-file-to-multiple-document/220352)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 0\ **Last updated:** [February 21, 2020, 12:24pm UTC](https://discuss.elastic.co/t/transfer-json-file-to-multiple-document/220352 "2020-02-21T12:24:56Z")
Json file has array lists. list has more than one arrays and want to generate document id from object in array. sample json {data\[ {mainCatName "cat1" id 1 subCat\[{ subcatId 32015, subcatName "subcat11"}, { sub… --- ## [Unknown setting error with s3 input plugin](https://discuss.elastic.co/t/unknown-setting-error-with-s3-input-plugin/220334)
**Author:** [@\_Alex](https://discuss.elastic.co/u/_Alex)\ **Replies:** 1\ **Last updated:** [February 21, 2020, 10:56am UTC](https://discuss.elastic.co/t/unknown-setting-error-with-s3-input-plugin/220334 "2020-02-21T10:56:43Z")
When using the s3 input plugin with this configuration: input { s3 { "bucket" =\> "my-bucket-name" "add\_field" =\> { "service" =\> "aws-access-log-alb" "environment" =\> "demo" } } } I get these… --- ## [Logstash - Aggregate filter - one more field](https://discuss.elastic.co/t/logstash-aggregate-filter-one-more-field/220312)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 10:23am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-one-more-field/220312 "2020-02-21T10:23:19Z")
Hello, I created aggregate filter. --- ## [Logstash SSL enable to connect elastic cloud instance](https://discuss.elastic.co/t/logstash-ssl-enable-to-connect-elastic-cloud-instance/220110)
**Author:** [@Rahul12](https://discuss.elastic.co/u/Rahul12)\ **Replies:** 3\ **Last updated:** [February 21, 2020, 8:55am UTC](https://discuss.elastic.co/t/logstash-ssl-enable-to-connect-elastic-cloud-instance/220110 "2020-02-21T08:55:41Z")
Hi, I am using elastic cloud version 7.5.1. I have enable SAML to my elastic cloud instance. Before enabling SAML my logstash which is at my local able to connect with elastic cloud instance. But after enabling SAML s… --- ## [Logstash : ingestion via Grok pattern does not work](https://discuss.elastic.co/t/logstash-ingestion-via-grok-pattern-does-not-work/220003)
**Author:** [@romainfoulono](https://discuss.elastic.co/u/romainfoulono)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 8:12am UTC](https://discuss.elastic.co/t/logstash-ingestion-via-grok-pattern-does-not-work/220003 "2020-02-21T08:12:46Z")
Hello everybody, I wish to ingest some CSV and texts in Elasticsearch via Logstash. Problem is than Logstash generates a unique field named « message » with the text line inside. I would like to split this text line int… --- ## [Can we join multiple index in Logstash after reading for elasticsearch and then create a new index](https://discuss.elastic.co/t/can-we-join-multiple-index-in-logstash-after-reading-for-elasticsearch-and-then-create-a-new-index/220086)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 1\ **Last updated:** [February 21, 2020, 7:25am UTC](https://discuss.elastic.co/t/can-we-join-multiple-index-in-logstash-after-reading-for-elasticsearch-and-then-create-a-new-index/220086 "2020-02-21T07:25:20Z")
Hi Team, I have my data of three different views ingested in Elasticsearch as three different indices. Now I have a requirement to create a Dashboard in Kibana with the combination of data from three views. So now I nee… --- ## [How to match a sentence that may contain delimiter](https://discuss.elastic.co/t/how-to-match-a-sentence-that-may-contain-delimiter/220070)
**Author:** [@kingjherold](https://discuss.elastic.co/u/kingjherold)\ **Replies:** 2\ **Last updated:** [February 21, 2020, 1:40am UTC](https://discuss.elastic.co/t/how-to-match-a-sentence-that-may-contain-delimiter/220070 "2020-02-21T01:40:52Z")
This is the log line msg: Malware/Virus detected - Rtf.Exploit.CVE\_2017\_11882-6584355-0:Message denied for delivery:Announcement: Holiday Tomorrow This is where i'm figuring out how to match the "Announcement: Holida… --- ## [Elasticsearch input not returning all data and Logstash closing](https://discuss.elastic.co/t/elasticsearch-input-not-returning-all-data-and-logstash-closing/220273)
**Author:** [@bradley.bristowstagg](https://discuss.elastic.co/u/bradley.bristowstagg)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 10:39pm UTC](https://discuss.elastic.co/t/elasticsearch-input-not-returning-all-data-and-logstash-closing/220273 "2020-02-20T22:39:07Z")
Hey all, I'm using the current Logstash docker and am trying to pull all of the main "message" field from some existing indexes so that I can re-enrich them and move to a new index. Only problem is that logstash is clos… --- ## [Load cloudwatch to logstash](https://discuss.elastic.co/t/load-cloudwatch-to-logstash/219812)
**Author:** [@Amna\_sayed\_ali](https://discuss.elastic.co/u/Amna_sayed_ali)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 7:07pm UTC](https://discuss.elastic.co/t/load-cloudwatch-to-logstash/219812 "2020-02-20T19:07:46Z")
Hi, I use AWS ES and Logstash as an aggregator. I want to load Cloudwatch logs (that located in a different account, for example, account B) into Logstash (that located in account A) i use Logstash-cloudwatch plugin bu… --- ## [Using ruby filter to sum values of nested objects everytime the event matches](https://discuss.elastic.co/t/using-ruby-filter-to-sum-values-of-nested-objects-everytime-the-event-matches/220248)
**Author:** [@Kassio\_Silva](https://discuss.elastic.co/u/Kassio_Silva)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 6:20pm UTC](https://discuss.elastic.co/t/using-ruby-filter-to-sum-values-of-nested-objects-everytime-the-event-matches/220248 "2020-02-20T18:20:15Z")
Hello guys, I trying to sum the value of a specific field everytime it shows: the field is in this format: "\[cdr\]\[Service-Information\]\[PS-Information\]\[Service-Data-Container\]\[Accounting-Output-Octets\]" and it's value i… --- ## [Logstash split xml filter](https://discuss.elastic.co/t/logstash-split-xml-filter/220018)
**Author:** [@MarcoV](https://discuss.elastic.co/u/MarcoV)\ **Replies:** 5\ **Last updated:** [February 20, 2020, 6:02pm UTC](https://discuss.elastic.co/t/logstash-split-xml-filter/220018 "2020-02-20T18:02:35Z")
Hi all, I have a some problem with my logstash filter. I read data from an xml and I want to split them to send to elasticsearch. The xml is like this: \ \ \/Subasio.aac\ … --- ## [Erro logstash](https://discuss.elastic.co/t/erro-logstash/220241)
**Author:** [@FernandoMOTA](https://discuss.elastic.co/u/FernandoMOTA)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 5:45pm UTC](https://discuss.elastic.co/t/erro-logstash/220241 "2020-02-20T17:45:21Z")
Even using version 11 of the jdk this error occurs, I am using the most current version . /bin/logstash -e 'input { stdin { } } output { stdout {} }' Unrecognized option: - Error: Could not create the Java Virtual Mac… --- ## [Logstash / input - Elasticsearch query question](https://discuss.elastic.co/t/logstash-input-elasticsearch-query-question/220239)
**Author:** [@RoNo](https://discuss.elastic.co/u/RoNo)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 5:42pm UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-query-question/220239 "2020-02-20T17:42:32Z")
is it possible to query frozen indexes with the elasticsearch input module in logstash? i am trying to query all my frozen indexes with logstash and the ES input module if i try to query a frozen index in kibana or cur… --- ## [Get count of indexing conflicts](https://discuss.elastic.co/t/get-count-of-indexing-conflicts/220232)
**Author:** [@mmarkzon](https://discuss.elastic.co/u/mmarkzon)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 4:58pm UTC](https://discuss.elastic.co/t/get-count-of-indexing-conflicts/220232 "2020-02-20T16:58:45Z")
I have some indices with duplicate id's that I am using Logstash to de-dupe into another index in another cluster. Is there a way to have logstash report the number of conflicts that occurred? This would be comparable … --- ## [Logstash as a service config not working](https://discuss.elastic.co/t/logstash-as-a-service-config-not-working/219836)
**Author:** [@sdkeslar](https://discuss.elastic.co/u/sdkeslar)\ **Replies:** 6\ **Last updated:** [February 20, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-as-a-service-config-not-working/219836 "2020-02-20T16:47:28Z")
Trying to get a new install of LogStash running as a service on Ubuntu 18.04 LTS. I can start it ok as root, but it won't start using systemctl. /etc/systemd/system/logstash.service: \[Unit\] Description=logstash \[Serv… --- ## [Logstash stuck on "Will Retry with exponential backoff"](https://discuss.elastic.co/t/logstash-stuck-on-will-retry-with-exponential-backoff/220221)
**Author:** [@TDV](https://discuss.elastic.co/u/TDV)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 3:52pm UTC](https://discuss.elastic.co/t/logstash-stuck-on-will-retry-with-exponential-backoff/220221 "2020-02-20T15:52:47Z")
Hi, We use ELK 7.5.1 version It seems that logstash stucks on trying to make bulk requests to elastic when document size exceeded http.max\_content\_length: \[ERROR\]\[logstash.outputs.elasticsearch\]\[index\_name\] Encountere… --- ## [Add new field to existing documents in an index from logstash is recreating the index](https://discuss.elastic.co/t/add-new-field-to-existing-documents-in-an-index-from-logstash-is-recreating-the-index/217096)
**Author:** [@Sivaraman\_Subbiah](https://discuss.elastic.co/u/Sivaraman_Subbiah)\ **Replies:** 3\ **Last updated:** [February 20, 2020, 3:33pm UTC](https://discuss.elastic.co/t/add-new-field-to-existing-documents-in-an-index-from-logstash-is-recreating-the-index/217096 "2020-02-20T15:33:24Z")
Hi, My setup includes using logstash 7.2.0 to fetch records from database and push to Elasticsearch. I have a requirement to add new field to existing documents in an index plus index new documents with the new field v… --- ## [Logstash to logstash communication: Connection reset by peer error](https://discuss.elastic.co/t/logstash-to-logstash-communication-connection-reset-by-peer-error/219858)
**Author:** [@Riddhesh](https://discuss.elastic.co/u/Riddhesh)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 3:33pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-communication-connection-reset-by-peer-error/219858 "2020-02-20T15:33:08Z")
I'm trying to setup logstash to logstash setup(veresion 6.1.3 on both), using lumberjack output and beats input as per guide. My sender config output looks like (the sender input produces around 600 events per sec): ou… --- ## [Logstash: Beats input and filters](https://discuss.elastic.co/t/logstash-beats-input-and-filters/220212)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 3:01pm UTC](https://discuss.elastic.co/t/logstash-beats-input-and-filters/220212 "2020-02-20T15:01:36Z")
I have a problem. I have a pipeline in Logstash. I use beats at the entrance. Beats. Logs are sent by Winlogbeat. Everything works okay. But there is a problem. I want to copy the value of a new field to another fie… --- ## [Why is this (specific) mutate not working?](https://discuss.elastic.co/t/why-is-this-specific-mutate-not-working/219029)
**Author:** [@Dennis\_Bohs](https://discuss.elastic.co/u/Dennis_Bohs)\ **Replies:** 10\ **Last updated:** [February 20, 2020, 2:39pm UTC](https://discuss.elastic.co/t/why-is-this-specific-mutate-not-working/219029 "2020-02-20T14:39:35Z")
Hi Folks, it has been some time since i asked my last question here and i learned a lot in the meantime, but i still feel like a bloody beginner from time to time. Here comes my Situation: I am filtering several logs … --- ## [Trouble sending GELF event - Graylog](https://discuss.elastic.co/t/trouble-sending-gelf-event-graylog/219048)
**Author:** [@djbrunoatimix](https://discuss.elastic.co/u/djbrunoatimix)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 1:00pm UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event-graylog/219048 "2020-02-20T13:00:16Z")
Hello guys, Could someone help me? I am having some issue when trying to push data to Graylog. At the moment I am testing my environment, and everything is working properly. Filebeat -\> Logstash -\> Graylog -\> Elastics… --- ## [\[HELP\] Xml xpath dynamic destination-field](https://discuss.elastic.co/t/help-xml-xpath-dynamic-destination-field/220157)
**Author:** [@FajarFebriano](https://discuss.elastic.co/u/FajarFebriano)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 10:26am UTC](https://discuss.elastic.co/t/help-xml-xpath-dynamic-destination-field/220157 "2020-02-20T10:26:22Z")
Based on documentation Logstash Xpath My XML Format : \ \