# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=406 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 407 --- ## [After update to logstash 7.6.0, it won't start](https://discuss.elastic.co/t/after-update-to-logstash-7-6-0-it-wont-start/218861)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 4\ **Last updated:** [February 12, 2020, 6:40am UTC](https://discuss.elastic.co/t/after-update-to-logstash-7-6-0-it-wont-start/218861 "2020-02-12T06:40:18Z")
Hi, I updated from 7.5.2 to 7.6.0 (debian stretch). The log gves me the following error, I struggle to see where this comes from: \[2020-02-11T21:30:28,078\]\[ERROR\]\[logstash.agent \] Failed to execute action {:a… --- ## [How can we use "filter" settings in logstash-input-journald plugin?](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 8\ **Last updated:** [February 12, 2020, 6:28am UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374 "2020-02-12T06:28:51Z")
Hi, Please let me know in detail how to use filter keyword in logstash input configuration of logstash input jouranld plugin? my aim to parse only some logs not all so how to do that. use of this ..... Filter on even… --- ## [CAN LOGSTASH OUTPUT TO A DATABASE](https://discuss.elastic.co/t/can-logstash-output-to-a-database/218485)
**Author:** [@Adam\_Songambele](https://discuss.elastic.co/u/Adam_Songambele)\ **Replies:** 4\ **Last updated:** [February 12, 2020, 4:08am UTC](https://discuss.elastic.co/t/can-logstash-output-to-a-database/218485 "2020-02-12T04:08:00Z")
hi, i am new to the ELK stack and i have a few question, I have case study that consist in collecting logs that can be saved in a database which could then be pulled down by a bot connect to a user to perform several t… --- ## [Haproxy log parsed with grok](https://discuss.elastic.co/t/haproxy-log-parsed-with-grok/218889)
**Author:** [@julian6709](https://discuss.elastic.co/u/julian6709)\ **Replies:** 0\ **Last updated:** [February 12, 2020, 3:44am UTC](https://discuss.elastic.co/t/haproxy-log-parsed-with-grok/218889 "2020-02-12T03:44:17Z")
Can some one please help on creating the proper grok parse for that haproxy string below? I am new in this magical logstash world :wink: "\<134\>Jan 30 20:25:51 haproxy\[8265\]: 192.168.1.10:57176 \[30/Jan/2020:20:25:50.490… --- ## [Failed to publish events caused by: i/o timeout while sending logs to logstash](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-i-o-timeout-while-sending-logs-to-logstash/218885)
**Author:** [@zhang\_you](https://discuss.elastic.co/u/zhang_you)\ **Replies:** 0\ **Last updated:** [February 12, 2020, 3:12am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-i-o-timeout-while-sending-logs-to-logstash/218885 "2020-02-12T03:12:05Z")
my filebeat and logstash are both version 7.5.2. my filebeat.yml is and my logstash.conf is .and other config file are default.When i run this,the error is "Failed to publish events caused by: read tcp 127.0.0.1:64356-\>… --- ## [Add field if the input file comes from a certain path](https://discuss.elastic.co/t/add-field-if-the-input-file-comes-from-a-certain-path/218859)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 4\ **Last updated:** [February 12, 2020, 2:44am UTC](https://discuss.elastic.co/t/add-field-if-the-input-file-comes-from-a-certain-path/218859 "2020-02-12T02:44:14Z")
Hi I want to add a field depending on the path of the input log file, something like this: input { file { path =\> "some\_path/uptime\*" path =\> "some\_other\_path/uptime\*" … --- ## [Looks like you either have a bad certificate, an invalid key or your private key was not in PKCS8 format](https://discuss.elastic.co/t/looks-like-you-either-have-a-bad-certificate-an-invalid-key-or-your-private-key-was-not-in-pkcs8-format/218856)
**Author:** [@gowthamgts](https://discuss.elastic.co/u/gowthamgts)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 9:18pm UTC](https://discuss.elastic.co/t/looks-like-you-either-have-a-bad-certificate-an-invalid-key-or-your-private-key-was-not-in-pkcs8-format/218856 "2020-02-11T21:18:07Z")
I'm trying to enable tls security for my stack and keep getting Looks like you either have a bad certificate, an invalid key or your private key was not in PKCS8 format. errors even though I've given my keys in pkcs8 for… --- ## [Elastic Logstash Helm Chart Doesn't Pass Readiness Probe](https://discuss.elastic.co/t/elastic-logstash-helm-chart-doesnt-pass-readiness-probe/218835)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 6:53pm UTC](https://discuss.elastic.co/t/elastic-logstash-helm-chart-doesnt-pass-readiness-probe/218835 "2020-02-11T18:53:00Z")
I have multiple logstash pods deployed, segregated by function. I am experiencing an issue where, when I have xpack.monitoring configured, the helm chart readiness and liveness probes don't ever show that the pod is read… --- ## [New logstash output plugin not getting config value correctly](https://discuss.elastic.co/t/new-logstash-output-plugin-not-getting-config-value-correctly/218786)
**Author:** [@fostec82](https://discuss.elastic.co/u/fostec82)\ **Replies:** 3\ **Last updated:** [February 11, 2020, 3:52pm UTC](https://discuss.elastic.co/t/new-logstash-output-plugin-not-getting-config-value-correctly/218786 "2020-02-11T15:52:19Z")
I am attempting to create a new output plugin. The conf is pretty simple input { stdin{} } filter { mutate { add\_field =\> { "\[some\_new\_field\]" =\> "some\_new\_field\_value" } } } output { mynewpl… --- ## [Translate csv failed - caused by a missing field](https://discuss.elastic.co/t/translate-csv-failed-caused-by-a-missing-field/218522)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 2\ **Last updated:** [February 11, 2020, 3:51pm UTC](https://discuss.elastic.co/t/translate-csv-failed-caused-by-a-missing-field/218522 "2020-02-11T15:51:05Z")
Logstash 7.3.1 I read from csv: columns =\> \["field1","field2","field3","field4","field5","field6","field7","field8","field9","field10","field11","field12","CustomID","field13","field14"\] Then I want to enrich my doc… --- ## [Logstash - Load error](https://discuss.elastic.co/t/logstash-load-error/217654)
**Author:** [@jaugsuto](https://discuss.elastic.co/u/jaugsuto)\ **Replies:** 2\ **Last updated:** [February 11, 2020, 3:25pm UTC](https://discuss.elastic.co/t/logstash-load-error/217654 "2020-02-11T15:25:54Z")
Hi I have installed already several times the elastic stack all via the tar.gz files. This error that im having now is only regarding Logstash. When I start Logstash is returns this error \[ERROR\] 2020-02-03 15:10:23… --- ## [Logstash is essential or not](https://discuss.elastic.co/t/logstash-is-essential-or-not/218204)
**Author:** [@opensourcengineer](https://discuss.elastic.co/u/opensourcengineer)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 3:17pm UTC](https://discuss.elastic.co/t/logstash-is-essential-or-not/218204 "2020-02-11T15:17:58Z")
hi team, i have installed filebeat on my syslog server and in kibana i configured the output to elasticsearch so in this case i am getting the syslog server logs directly to kibana dashboard using the filebeat module sy… --- ## [\[logstash.outputs.elasticsearch\]\[.monitoring-logstash\] An unknown error occurred sending a bulk request to Elasticsearch](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-monitoring-logstash-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch/218781)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [February 11, 2020, 1:59pm UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-monitoring-logstash-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch/218781 "2020-02-11T13:59:30Z")
Hi, I installed logstash 7.4.2 via rpm. Logstash is accessing elasticsearch's rest api via haproxy, wich is loadbalancing between the elasticsearch nodes. TLS is tunneled from client, so no re-encryption on haproxy side… --- ## [Logstash grok filter only extracting first match](https://discuss.elastic.co/t/logstash-grok-filter-only-extracting-first-match/218219)
**Author:** [@tmuon](https://discuss.elastic.co/u/tmuon)\ **Replies:** 4\ **Last updated:** [February 11, 2020, 1:50pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-only-extracting-first-match/218219 "2020-02-11T13:50:40Z")
Hi. Elastic Stack 7.4 in use here. I'm using the grok filter in logstash to extract data from a connection event from a Cisco Firepower. The syslog data is sent to Filebeat on a separate computer and the Filebeat Cisco m… --- ## [Parsing Syslog to Logstash](https://discuss.elastic.co/t/parsing-syslog-to-logstash/218564)
**Author:** [@marvine82](https://discuss.elastic.co/u/marvine82)\ **Replies:** 5\ **Last updated:** [February 11, 2020, 12:17pm UTC](https://discuss.elastic.co/t/parsing-syslog-to-logstash/218564 "2020-02-11T12:17:31Z")
Hey; im currently trying to parse my syslog events to my elasticsearch host over logstash. I created a new .conf file under /etc/logstash/conf.d called syslog.conf. This file looks like this: input { syslog { port… --- ## [Postgres output from json type doesn't work, writes null values](https://discuss.elastic.co/t/postgres-output-from-json-type-doesnt-work-writes-null-values/218548)
**Author:** [@ActionAdi83](https://discuss.elastic.co/u/ActionAdi83)\ **Replies:** 4\ **Last updated:** [February 11, 2020, 10:22am UTC](https://discuss.elastic.co/t/postgres-output-from-json-type-doesnt-work-writes-null-values/218548 "2020-02-11T10:22:25Z")
Hello, I need a little help, I'm trying to write from a kafka topic to a postgres table only specific fields and it doesn't work, it writes nulls. I haven't figured out how to post jsons to kafka topic so I'm getting t… --- ## [Wait for file input plugin 90 seconds](https://discuss.elastic.co/t/wait-for-file-input-plugin-90-seconds/217627)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 3\ **Last updated:** [February 11, 2020, 10:27am UTC](https://discuss.elastic.co/t/wait-for-file-input-plugin-90-seconds/217627 "2020-02-11T10:27:46Z")
I'm using input plugin to load CSV files into ES. Since files are created on another machine and afterward copied to local filesystem, I need to wait for file to completely be copied. We have issues with reading files (i… --- ## [Logstash fails to connect to RabbitMQ, complains about auth issue](https://discuss.elastic.co/t/logstash-fails-to-connect-to-rabbitmq-complains-about-auth-issue/218741)
**Author:** [@karlsson](https://discuss.elastic.co/u/karlsson)\ **Replies:** 0\ **Last updated:** [February 11, 2020, 9:26am UTC](https://discuss.elastic.co/t/logstash-fails-to-connect-to-rabbitmq-complains-about-auth-issue/218741 "2020-02-11T09:26:24Z")
I am deploying RabbitMQ with Elaasticsearch and Logstash using Docker Compose. I can login with the user I create to RabbitMQ UI. However, the same credentials aren't good for Logstash: \[2020-02-11T03:18:20,616\]\[ERROR\]… --- ## [Running script from logstash](https://discuss.elastic.co/t/running-script-from-logstash/218731)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 9:03am UTC](https://discuss.elastic.co/t/running-script-from-logstash/218731 "2020-02-11T09:03:29Z")
Hi Team, Quick Question, Can we run any script that is present in our system, from logstash configuration output section? Thanks --- ## [Logstash::ConfigurationError:message=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"input\\", \\"filter\\", \\"output\\" at line 3, column 1 (byte 3) after \\n\\n"](https://discuss.elastic.co/t/logstash-message-expected-one-of-t-r-n-input-filter-output-at-line-3-column-1-byte-3-after-n-n/218723)
**Author:** [@Varun\_Saraf](https://discuss.elastic.co/u/Varun_Saraf)\ **Replies:** 0\ **Last updated:** [February 11, 2020, 7:31am UTC](https://discuss.elastic.co/t/logstash-message-expected-one-of-t-r-n-input-filter-output-at-line-3-column-1-byte-3-after-n-n/218723 "2020-02-11T07:31:59Z")
logstash shows the following error. what is the error in configuration file? VARSARAF-M-PAPE:~ varsaraf$ logstash -f /usr/local/etc/logstash/conf.d/syslog.conf Thread.exclusive is deprecated, use Thread::Mutex Sending… --- ## [Logstash Unit test](https://discuss.elastic.co/t/logstash-unit-test/218721)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 0\ **Last updated:** [February 11, 2020, 7:23am UTC](https://discuss.elastic.co/t/logstash-unit-test/218721 "2020-02-11T07:23:42Z")
Hi Is there any official tool for unit testing logstash config file?? --- ## [Could not index event to Elasticsearch. Logstash date filter](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-logstash-date-filter/218600)
**Author:** [@MPiorunn](https://discuss.elastic.co/u/MPiorunn)\ **Replies:** 3\ **Last updated:** [February 11, 2020, 7:23am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-logstash-date-filter/218600 "2020-02-11T07:23:22Z")
Hello, I am constantly getting \_dateparsefailure tag in Logstash output and because I am not using Time Filter in Index Patterns, I am getting an error : Could not index event to Elasticsearch. Preview of field's value:… --- ## [Additional string in existing logstash config file to index haproxy](https://discuss.elastic.co/t/additional-string-in-existing-logstash-config-file-to-index-haproxy/218690)
**Author:** [@julian6709](https://discuss.elastic.co/u/julian6709)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 11:40pm UTC](https://discuss.elastic.co/t/additional-string-in-existing-logstash-config-file-to-index-haproxy/218690 "2020-02-10T23:40:33Z")
Hi I am very new in logstash and ELK, can some one help me to create proper string in the logstash config file to index some fields? Example: "\<134\>Jan 30 20:25:51 haproxy\[8265\]: 192.168.1.10:57176 \[30/Jan/2020:20:25:5… --- ## [Http table convert in docs](https://discuss.elastic.co/t/http-table-convert-in-docs/218673)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 11:16pm UTC](https://discuss.elastic.co/t/http-table-convert-in-docs/218673 "2020-02-10T23:16:34Z")
Hello, I need tips to convert a health Check Http table in many doc's using a pipeline. I only want transform table and in many doc's and columns in different field. I thought in getting page in txt and replace in a … --- ## [Trouble splitting out json array into component elements](https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647)
**Author:** [@Jeff\_Morton](https://discuss.elastic.co/u/Jeff_Morton)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 9:08pm UTC](https://discuss.elastic.co/t/trouble-splitting-out-json-array-into-component-elements/218647 "2020-02-10T21:08:36Z")
What would be the correct approach to break a field representing a json array into new data fields representing the various component elements? For instance I have a field that contains the following data. \[{"id": "8b5… --- ## [Drop part of a fieldname](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660)
**Author:** [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 7:43pm UTC](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660 "2020-02-10T19:43:53Z")
Looking for a more efficient way to drop the top part of Windows fields (winlog) for 50+ fields. The less efficient way would be to have unique mutate \> rename entries for each field. Any ideas on achieving this would b… --- ## [Filebeat to logstash](https://discuss.elastic.co/t/filebeat-to-logstash/218663)
**Author:** [@sunisola0202](https://discuss.elastic.co/u/sunisola0202)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 7:31pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash/218663 "2020-02-10T19:31:32Z")
I am connecting filebeat to logstash Getting below errors 2020-02-11T03:30:44.949+0800 ERROR logstash/async.go:256 Failed to publish events caused by: read tcp 192.168.211.31:48788-\>192.168.215.31:9999: i/o timeout 20… --- ## [Merge or combine 2 different input fields as 1](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420)
**Author:** [@jrodbor](https://discuss.elastic.co/u/jrodbor)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 7:11pm UTC](https://discuss.elastic.co/t/merge-or-combine-2-different-input-fields-as-1/218420 "2020-02-10T19:11:19Z")
Hello, I the input CSV file I have the timestamp file separate by a TAB, one as "date" and another as "time", is it possible load is as the timestamp one ? What is the code to doing it ? input { file { path =\> "/Use… --- ## [Logstash only adding one document from mongodb to elasticsearch](https://discuss.elastic.co/t/logstash-only-adding-one-document-from-mongodb-to-elasticsearch/218639)
**Author:** [@tahaimt](https://discuss.elastic.co/u/tahaimt)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 4:39pm UTC](https://discuss.elastic.co/t/logstash-only-adding-one-document-from-mongodb-to-elasticsearch/218639 "2020-02-10T16:39:10Z")
I am trying to index my mongodb collections in elasticsearch with logstash and to verify that the data is indexed in elasticsearch I am using kibana. Pasted below are my docker-compose and logstash.conf files. After up-i… --- ## [Csv filter plugin mapping problem](https://discuss.elastic.co/t/csv-filter-plugin-mapping-problem/216887)
**Author:** [@mhyager](https://discuss.elastic.co/u/mhyager)\ **Replies:** 6\ **Last updated:** [February 10, 2020, 4:21pm UTC](https://discuss.elastic.co/t/csv-filter-plugin-mapping-problem/216887 "2020-02-10T16:21:28Z")
Can somebody help me understand this error? \[2020-01-28T17:29:58,361\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[AMIENS\] \[llmlogs-2020.01-000001\]\[0\] failed to execute bulk item (index) index {\[llmlogs-2020.01-000001\]\[\_do… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=405) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=407)