# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=402 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 403 --- ## [Events Received Rate Suddenly Dropped](https://discuss.elastic.co/t/events-received-rate-suddenly-dropped/220096)
**Author:** [@ntran](https://discuss.elastic.co/u/ntran)\ **Replies:** 0\ **Last updated:** [February 20, 2020, 6:27am UTC](https://discuss.elastic.co/t/events-received-rate-suddenly-dropped/220096 "2020-02-20T06:27:15Z")
Hi all, I was looking at my stack monitoring and I was emitting just under 10,000 e/s and then all of a sudden it dropped to around 5,000 e/s and has stayed there. There were no changes made, so there shouldn't be a ~50… --- ## [From scripted field to logstash](https://discuss.elastic.co/t/from-scripted-field-to-logstash/220062)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 1:40am UTC](https://discuss.elastic.co/t/from-scripted-field-to-logstash/220062 "2020-02-20T01:40:51Z")
I dunno if this is the place, but since the destination is Logstash's ruby filter, I think it is. I have this massive scripted field... and I'm considering reindexing and adding it to the pipeline config, but I'm not re… --- ## [Timestamps filter](https://discuss.elastic.co/t/timestamps-filter/219648)
**Author:** [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Replies:** 7\ **Last updated:** [February 19, 2020, 8:48pm UTC](https://discuss.elastic.co/t/timestamps-filter/219648 "2020-02-19T20:48:03Z")
I cant get the "Time" field to match the message log filter { mutate { replace =\> { "type" =\> "logs" } } grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp}%{DATA}%{YEAR}\]%{DATA}%{SYSLOG5424SD:Alert}%{DATA}%… --- ## [How to implement post action after data loaded to index?](https://discuss.elastic.co/t/how-to-implement-post-action-after-data-loaded-to-index/220058)
**Author:** [@jbond](https://discuss.elastic.co/u/jbond)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 8:24pm UTC](https://discuss.elastic.co/t/how-to-implement-post-action-after-data-loaded-to-index/220058 "2020-02-19T20:24:13Z")
I am using logstash to load data from DB to ES index. Everything works. Now after the data loaded is completed, I want to run some post actions such as put the index in an alias, run some elastic search DSL query, get th… --- ## [SSL-enabled Beat ssl\_verify\_mode =\> "none" not working as expected](https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 2\ **Last updated:** [February 19, 2020, 8:05pm UTC](https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023 "2020-02-19T20:05:17Z")
TL;DR Using ssl\_verify\_mode =\> "none" in input.beats not functioning as expected; should allow unverified SSL connections, but doesn't. The rest of the story... I'm using SSL-enabled input.beat in my logstash.conf, whic… --- ## [Parsing postgresql logs](https://discuss.elastic.co/t/parsing-postgresql-logs/220017)
**Author:** [@Manoj\_kumar4](https://discuss.elastic.co/u/Manoj_kumar4)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 7:09pm UTC](https://discuss.elastic.co/t/parsing-postgresql-logs/220017 "2020-02-19T19:09:59Z")
Hi friends, Can you share grok pattern for Postgres logs (9.6+ version) 2020-02-18 12:33:21 UTC:10.32.75.210(32848):user@servicedb:\[24531\]:WARNING: there is no transaction in progress --- ## [Pipeline aborted due to error , Translation is missing](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-translation-is-missing/220019)
**Author:** [@sagardhakate](https://discuss.elastic.co/u/sagardhakate)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 6:55pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-translation-is-missing/220019 "2020-02-19T18:55:12Z")
input { file { path =\> "C:/Users/sagar.dhakate/Sagar\_FTTC.csv" start\_position =\> "beginning" sincedb\_path =\> "NULL" ignore\_older =\> 0 } } filter { csv { separator =\> "," columns =\> \["Product", "Date", "To… --- ## [Error 400](https://discuss.elastic.co/t/error-400/219936)
**Author:** [@Bruno1](https://discuss.elastic.co/u/Bruno1)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 4:33pm UTC](https://discuss.elastic.co/t/error-400/219936 "2020-02-19T16:33:51Z")
Hello I want create a mapping but I have the following error : \[ERROR\]\[logstash.outputs.elasticsearch\]\[main\] Failed to install template. {:message=\>"Got response code '400' contacting Elasticsearch at URL 'http://127.0… --- ## [Logstash on Kubernetes pipeline terminated if resources.limits.cpu/memory is set](https://discuss.elastic.co/t/logstash-on-kubernetes-pipeline-terminated-if-resources-limits-cpu-memory-is-set/220026)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 4:24pm UTC](https://discuss.elastic.co/t/logstash-on-kubernetes-pipeline-terminated-if-resources-limits-cpu-memory-is-set/220026 "2020-02-19T16:24:53Z")
When running Logstash (as a statefulset) on EKS with resources.limits.cpu/memory set, the pods tend to exit with the pipeline terminated message resulting in CrashLoopBackoffs. The input is a kafka stream. When I do a ku… --- ## [Flat text to json object](https://discuss.elastic.co/t/flat-text-to-json-object/219969)
**Author:** [@AdamJade](https://discuss.elastic.co/u/AdamJade)\ **Replies:** 3\ **Last updated:** [February 19, 2020, 3:48pm UTC](https://discuss.elastic.co/t/flat-text-to-json-object/219969 "2020-02-19T15:48:57Z")
Hi there I have a problem to transform this line form a log file line to a json object. The line is like this \[2020-02-14 14:33:08.882\] \[VALUE1\] \[VALUE2\] \[VALUE3\] \[VALUE4\] \[VALUE5\] \[VALUE6\] \[VALUE7\] \[VALUE8\] # Other t… --- ## [Logs Sequence not in Order](https://discuss.elastic.co/t/logs-sequence-not-in-order/219982)
**Author:** [@Himanshu\_Yadav](https://discuss.elastic.co/u/Himanshu_Yadav)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 2:44pm UTC](https://discuss.elastic.co/t/logs-sequence-not-in-order/219982 "2020-02-19T14:44:23Z")
Hi Team, We are facing an issue where logs on Kibana dashboard are not coming in its original sequence, as seen in the file attached below: --- ## [Improve performance of logstash data loading into elastic search](https://discuss.elastic.co/t/improve-performance-of-logstash-data-loading-into-elastic-search/219971)
**Author:** [@gourav\_gupta](https://discuss.elastic.co/u/gourav_gupta)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 2:41pm UTC](https://discuss.elastic.co/t/improve-performance-of-logstash-data-loading-into-elastic-search/219971 "2020-02-19T14:41:21Z")
Hi, I am trying to load data into elastic search using logstash, but loading time is not up to the mark. I have file size of around 5GB and having 30 million records. its taking around 12 min to insert into elasticsear… --- ## [Schedule cron job](https://discuss.elastic.co/t/schedule-cron-job/219977)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 2:33pm UTC](https://discuss.elastic.co/t/schedule-cron-job/219977 "2020-02-19T14:33:44Z")
Hi, I'm using http\_poller in input and running it with cron schedule. I have cron as \* 14 \* \* \* UTC. It is giving warning "warning: constant ::Fixnum is deprecated". Please suggest if this is expected and can be avoide… --- ## [About logstash monitoring api, need in 7.4](https://discuss.elastic.co/t/about-logstash-monitoring-api-need-in-7-4/219968)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 1:15pm UTC](https://discuss.elastic.co/t/about-logstash-monitoring-api-need-in-7-4/219968 "2020-02-19T13:15:23Z")
please let me know logstash monitoring api for pipeline? like we have it in logstash 5.0 curl -XGET localhost:9600/\_node/stats/pipeline,reload?pretty --- ## [Fatal Error in Logstash runner](https://discuss.elastic.co/t/fatal-error-in-logstash-runner/219966)
**Author:** [@Vishkaha](https://discuss.elastic.co/u/Vishkaha)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 12:56pm UTC](https://discuss.elastic.co/t/fatal-error-in-logstash-runner/219966 "2020-02-19T12:56:27Z")
Dear All, I am very new to Elastic search and while running simple.conf file logstash/bin directory i am facing the below mentioned Error \[FATAL\] 2020-02-19 12:49:55.504 \[LogStash::Runner\] runner - Logstash could not b… --- ## [Issue with parsing csv file via logstash with headers containing " \\\\headername \[abcd\]"](https://discuss.elastic.co/t/issue-with-parsing-csv-file-via-logstash-with-headers-containing-headername-abcd/219965)
**Author:** [@pratik322](https://discuss.elastic.co/u/pratik322)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 12:40pm UTC](https://discuss.elastic.co/t/issue-with-parsing-csv-file-via-logstash-with-headers-containing-headername-abcd/219965 "2020-02-19T12:40:53Z")
\[2020-02-19T18:12:34,475\]\[WARN \]\[logstash.filters.csv \]\[main\] Error parsing csv {:field=\>"message", :source=\>""85.266189861681553"\\r", :exception=\>#\ **Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 11:22am UTC](https://discuss.elastic.co/t/how-to-use-pipeline-java-execution-settings-in-logstash-7-4/219949 "2020-02-19T11:22:07Z") Is their any other setting apart from pipeline.java\_execution? Please let me know in detail what logstash does when we set false for pipeline.java\_execution. --- ## [Logstash and MQTT](https://discuss.elastic.co/t/logstash-and-mqtt/219932)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 9:41am UTC](https://discuss.elastic.co/t/logstash-and-mqtt/219932 "2020-02-19T09:41:38Z")
I have been looking for a way to get data from an MQTT broker into ES. The only thing i found were 2+ years old posts which didn't get me anywhere. This makes me wonder: Is there a specific reason why MQTT is not suppor… --- ## [Unable to connect](https://discuss.elastic.co/t/unable-to-connect/219597)
**Author:** [@rwr](https://discuss.elastic.co/u/rwr)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 9:09am UTC](https://discuss.elastic.co/t/unable-to-connect/219597 "2020-02-19T09:09:02Z")
how i fix this issue ? can somebody help ? thanks before --- ## [Understanding Logstash queues/pipelines](https://discuss.elastic.co/t/understanding-logstash-queues-pipelines/219927)
**Author:** [@277295c5e5a0848b93f5](https://discuss.elastic.co/u/277295c5e5a0848b93f5)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 8:59am UTC](https://discuss.elastic.co/t/understanding-logstash-queues-pipelines/219927 "2020-02-19T08:59:59Z")
Hi Team, I am using Logstash to ship logs to ES . There are a lot of wrong mapping/mapping violations in my logstash logs. We cannot correct these violation errors immediately in our ELK setup. Do these violations impa… --- ## [Grok pattern for the time which has some character attached to it](https://discuss.elastic.co/t/grok-pattern-for-the-time-which-has-some-character-attached-to-it/219898)
**Author:** [@Harish\_Kumar2](https://discuss.elastic.co/u/Harish_Kumar2)\ **Replies:** 2\ **Last updated:** [February 19, 2020, 8:29am UTC](https://discuss.elastic.co/t/grok-pattern-for-the-time-which-has-some-character-attached-to-it/219898 "2020-02-19T08:29:05Z")
i have log beginning with time and time format is like :slight\_smile: 09:16:07.080\_M\_I\_ \[10:06\] SO(000000000463f2a8 1629 2) i tried grok pattern grok { match =\> {"message" =\> "%{WORD:Timestamp}%{SPACE}%{GREEDYDATA:Lo… --- ## [SYSLOG, convert string message to JSON format](https://discuss.elastic.co/t/syslog-convert-string-message-to-json-format/219490)
**Author:** [@jakemeandi](https://discuss.elastic.co/u/jakemeandi)\ **Replies:** 8\ **Last updated:** [February 19, 2020, 7:01am UTC](https://discuss.elastic.co/t/syslog-convert-string-message-to-json-format/219490 "2020-02-19T07:01:02Z")
Hello all, Please allow me to declare that I am a newbie into logstash filtering (and in coding in general). I am a systems / networks engineer trying to learn something new. That being said, I have set up a 3node ELK… --- ## [Elasticsearch output indefinite retry on failure](https://discuss.elastic.co/t/elasticsearch-output-indefinite-retry-on-failure/219882)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 0\ **Last updated:** [February 19, 2020, 2:41am UTC](https://discuss.elastic.co/t/elasticsearch-output-indefinite-retry-on-failure/219882 "2020-02-19T02:41:22Z")
Is there anyway to stop multiple retries for an Elasticsearch output? Essentially if it has to retry more than 3 or 5 times then it should give the stack trace or error logs and then just terminate as is. Essentially jus… --- ## [Parsing date for @timestamp](https://discuss.elastic.co/t/parsing-date-for-timestamp/219873)
**Author:** [@AndyGarcia](https://discuss.elastic.co/u/AndyGarcia)\ **Replies:** 2\ **Last updated:** [February 19, 2020, 1:44am UTC](https://discuss.elastic.co/t/parsing-date-for-timestamp/219873 "2020-02-19T01:44:14Z")
I have a timestamp in my CSV file that's in this format: 3/3/2013 21:53 However, sometimes the format will change to: 3/4/2013 1:05 When I use this configuration file, it makes the timestamp the time I inject the data… --- ## [Logstash CPU used 100%](https://discuss.elastic.co/t/logstash-cpu-used-100/219847)
**Author:** [@focheur91300](https://discuss.elastic.co/u/focheur91300)\ **Replies:** 4\ **Last updated:** [February 18, 2020, 10:24pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847 "2020-02-18T22:24:07Z")
Hello community, I have been encountering for some time a problem with the use of 100% of my CPU, on my logstash configuration. The problem occurred overnight. I am using the docker version of logstash version 7.5.2. … --- ## [Failed to publish events caused by: read tcp 150.xxx.xxx.xxx:54336-\>150.xxx.xxx.xxx:5044: read: connection reset by peer](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp-150-xxx-xxx-xxx-54336-150-xxx-xxx-xxx-read-connection-reset-by-peer/219439)
**Author:** [@Heber\_Leandro](https://discuss.elastic.co/u/Heber_Leandro)\ **Replies:** 2\ **Last updated:** [February 18, 2020, 5:49pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp-150-xxx-xxx-xxx-54336-150-xxx-xxx-xxx-read-connection-reset-by-peer/219439 "2020-02-18T17:49:59Z")
i'm having a problem like this: Logstash on K8S spammed with Connection Reset By Peer does anyone know how to solve? --- ## [Trying to understand json parsing of Winlogbeats logs](https://discuss.elastic.co/t/trying-to-understand-json-parsing-of-winlogbeats-logs/219821)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [February 18, 2020, 4:24pm UTC](https://discuss.elastic.co/t/trying-to-understand-json-parsing-of-winlogbeats-logs/219821 "2020-02-18T16:24:29Z")
Hello there ! I've read lots of doc and forum topics but can't succeed to find a solution Winlogbeats are pushed to Kafka, then Logstash consume these logs I have the following (valid) json pulled on kafka by Logstas… --- ## [This works, but Id like it to be better? Improving Data fields to lookup faster in ES?](https://discuss.elastic.co/t/this-works-but-id-like-it-to-be-better-improving-data-fields-to-lookup-faster-in-es/219833)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 4:20pm UTC](https://discuss.elastic.co/t/this-works-but-id-like-it-to-be-better-improving-data-fields-to-lookup-faster-in-es/219833 "2020-02-18T16:20:17Z")
I have a 2 logstash instances. They both run the following code well. filter { grok { match =\> \[ "path", "%{GREEDYDATA}/%{GREEDYDATA:filename}\\.txt"\] } grok { match =\> { "message" =\> "%{DATA:sampleinfo}\[:;\]%{… --- ## [Parsing log line sends information twice](https://discuss.elastic.co/t/parsing-log-line-sends-information-twice/219652)
**Author:** [@AdamJade](https://discuss.elastic.co/u/AdamJade)\ **Replies:** 4\ **Last updated:** [February 18, 2020, 3:10pm UTC](https://discuss.elastic.co/t/parsing-log-line-sends-information-twice/219652 "2020-02-18T15:10:53Z")
Hi there Here is my log line \[2020/02/11-20:22:06.643\] !! Nom de classe de la BS : WXWXWX.Mtr.GpePayerEncaisser.Execution.Batchs.BS\_RequestExecution I want to obtain a message like this datetime : 2020/02/11-20:22:… --- ## [Logstash - http-Poller plugin fails to disable SSL validation](https://discuss.elastic.co/t/logstash-http-poller-plugin-fails-to-disable-ssl-validation/219785)
**Author:** [@prasanna2104](https://discuss.elastic.co/u/prasanna2104)\ **Replies:** 2\ **Last updated:** [February 18, 2020, 2:48pm UTC](https://discuss.elastic.co/t/logstash-http-poller-plugin-fails-to-disable-ssl-validation/219785 "2020-02-18T14:48:17Z")
Hi Team, I have installed logstash7.3.0 in the Linux server. I have created a configuration which will connect to the JIRA rest API using http\_poller plugin. Since our JIRA is self signed, and for testing purpose we are… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=401) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=403)