# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=413 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 414 --- ## [Logstash cef](https://discuss.elastic.co/t/logstash-cef/216957)
**Author:** [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)\ **Replies:** 1\ **Last updated:** [January 29, 2020, 8:28am UTC](https://discuss.elastic.co/t/logstash-cef/216957 "2020-01-29T08:28:42Z")
Good evening, I just started working with elk and I'm facing the issue of decoding/filter/split the cef file as you can see in the pic the CEF file contains some security alerts information which filter should i use t… --- ## [Unable to convert a column with Date and time format from string to date](https://discuss.elastic.co/t/unable-to-convert-a-column-with-date-and-time-format-from-string-to-date/216235)
**Author:** [@sama.sowjanya](https://discuss.elastic.co/u/sama.sowjanya)\ **Replies:** 4\ **Last updated:** [January 29, 2020, 6:46am UTC](https://discuss.elastic.co/t/unable-to-convert-a-column-with-date-and-time-format-from-string-to-date/216235 "2020-01-29T06:46:43Z")
Hi... my csv file contains closedDate with only date(e.g: 9/3/2019) and createdDate with date and time(e.g: 9/4/2019 06:40). I'm able to convert "closedDate" field to date format but "createdDate" field is remaining as … --- ## [Multiple Logstash to a single Elasticsearch](https://discuss.elastic.co/t/multiple-logstash-to-a-single-elasticsearch/216764)
**Author:** [@Prajwal\_Bhusari](https://discuss.elastic.co/u/Prajwal_Bhusari)\ **Replies:** 3\ **Last updated:** [January 29, 2020, 5:08am UTC](https://discuss.elastic.co/t/multiple-logstash-to-a-single-elasticsearch/216764 "2020-01-29T05:08:50Z")
I had to make a log analyzer. My friend has created a same thing last year to analyze log using ELK stack but it take 30-40 mins for logstash processing in his project. Is there any way that I can use multiple Logstash i… --- ## [Avaya IP Office 500 R11 SMDR -\> Logstash](https://discuss.elastic.co/t/avaya-ip-office-500-r11-smdr-logstash/215340)
**Author:** [@Adrien\_Carlyle](https://discuss.elastic.co/u/Adrien_Carlyle)\ **Replies:** 3\ **Last updated:** [January 28, 2020, 11:09pm UTC](https://discuss.elastic.co/t/avaya-ip-office-500-r11-smdr-logstash/215340 "2020-01-28T23:09:03Z")
Just wanted to share my configuration with the community after refining it for the better part of a week. Being new to the ELK stack it took a bit of time to understand how to get tcp flows into the platform. There was… --- ## [How to change the Logstash console log timezone (UTC -\> localtime)](https://discuss.elastic.co/t/how-to-change-the-logstash-console-log-timezone-utc-localtime/216903)
**Author:** [@Gelinski](https://discuss.elastic.co/u/Gelinski)\ **Replies:** 1\ **Last updated:** [January 28, 2020, 10:03pm UTC](https://discuss.elastic.co/t/how-to-change-the-logstash-console-log-timezone-utc-localtime/216903 "2020-01-28T22:03:53Z")
I want change the timezone of Logstash console output (logs) to my localtime. Example: \[WARN \] 2020-01-28 18:30:06.611 \[Ruby-0-Thread-15: /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch… --- ## [Parsing timestamps with two-digit offsets](https://discuss.elastic.co/t/parsing-timestamps-with-two-digit-offsets/216885)
**Author:** [@SpeedDaemon](https://discuss.elastic.co/u/SpeedDaemon)\ **Replies:** 1\ **Last updated:** [January 28, 2020, 10:00pm UTC](https://discuss.elastic.co/t/parsing-timestamps-with-two-digit-offsets/216885 "2020-01-28T22:00:38Z")
The date filter seems to be able to handle TZ names, or offsets formatted as -0600 or -06:00. Mine are 2020-01-24 15:11:30-06. I can't find anything in the date filter documentation on how to handle just a two-digit offs… --- ## [Logstash add tag](https://discuss.elastic.co/t/logstash-add-tag/216917)
**Author:** [@garcesdavid](https://discuss.elastic.co/u/garcesdavid)\ **Replies:** 0\ **Last updated:** [January 28, 2020, 9:26pm UTC](https://discuss.elastic.co/t/logstash-add-tag/216917 "2020-01-28T21:26:50Z")
Hello elastic forum I am learning some logstash concepts in katacoda.com (actual company's mandatory trainings and I've choose logstash). I've completed a lot of 'hands-ons' so far. The thing is that I reach a point wh… --- ## [Unable to properly use Logstash](https://discuss.elastic.co/t/unable-to-properly-use-logstash/216726)
**Author:** [@plisovyi](https://discuss.elastic.co/u/plisovyi)\ **Replies:** 6\ **Last updated:** [January 28, 2020, 9:23pm UTC](https://discuss.elastic.co/t/unable-to-properly-use-logstash/216726 "2020-01-28T21:23:22Z")
Hi, I am unable to launch Logstash. Elasticsearch and Kibana are both running When I execute the following command: bin\\logstash.bat -f .\\config\\logstash-sample.conf I get this: \> Java HotSpot(TM) 64-Bit Server VM… --- ## [Aggregate filter plugin - problem how to construct the filter](https://discuss.elastic.co/t/aggregate-filter-plugin-problem-how-to-construct-the-filter/216690)
**Author:** [@skjoos](https://discuss.elastic.co/u/skjoos)\ **Replies:** 6\ **Last updated:** [January 28, 2020, 2:59pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-problem-how-to-construct-the-filter/216690 "2020-01-28T14:59:01Z")
Hello! I'm trying to aggregate some data from a MS SQL database by using Logstash. Below is a view of the database. The jbdc field and my aggregation filter look like this: jdbc { .... sta… --- ## [Facing issue in getting all the agent.hostname](https://discuss.elastic.co/t/facing-issue-in-getting-all-the-agent-hostname/216775)
**Author:** [@yash\_kumar\_shah](https://discuss.elastic.co/u/yash_kumar_shah)\ **Replies:** 0\ **Last updated:** [January 28, 2020, 8:12am UTC](https://discuss.elastic.co/t/facing-issue-in-getting-all-the-agent-hostname/216775 "2020-01-28T08:12:23Z")
Hi I have successfully setup elk stack version 7.5.2 and migrated one of my complete applications to send logs and get it to visualize on kibana. Now I am trying to onboard another application using filebeat and adding … --- ## [Elasticsearch input plugin tracking timestamp](https://discuss.elastic.co/t/elasticsearch-input-plugin-tracking-timestamp/216790)
**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\ **Replies:** 0\ **Last updated:** [January 28, 2020, 9:16am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-tracking-timestamp/216790 "2020-01-28T09:16:47Z")
Hi everyone. I need to use elasticsearch as input plugin for my logstash configuration. I also need to schedule it ever n minutes and I want to track the timestamp in order to get from the query only the documents I hav… --- ## [Tracking column not found in dataset](https://discuss.elastic.co/t/tracking-column-not-found-in-dataset/216377)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 7\ **Last updated:** [January 28, 2020, 9:10am UTC](https://discuss.elastic.co/t/tracking-column-not-found-in-dataset/216377 "2020-01-28T09:10:15Z")
Good morning, I've an issue with the tracking\_column with the mysql plug-in. the conf.d input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/KPIS?useSSL=false" jdbc\_user =\> "labo" jdbc\_p… --- ## [Trying to get the data from oracle database through logstash but data is not coming to elasticsearch](https://discuss.elastic.co/t/trying-to-get-the-data-from-oracle-database-through-logstash-but-data-is-not-coming-to-elasticsearch/215678)
**Author:** [@uday\_kumar1](https://discuss.elastic.co/u/uday_kumar1)\ **Replies:** 9\ **Last updated:** [January 28, 2020, 8:45am UTC](https://discuss.elastic.co/t/trying-to-get-the-data-from-oracle-database-through-logstash-but-data-is-not-coming-to-elasticsearch/215678 "2020-01-28T08:45:15Z")
I am trying to get the data of oracle database through logstash but data is not coming to elasticsearch. not sure where i was missed. I didn't see any error on logstash log file. below are the logstash conf file. input … --- ## [Logstash 6.8.4 crashing while scheduling job from crontab](https://discuss.elastic.co/t/logstash-6-8-4-crashing-while-scheduling-job-from-crontab/216766)
**Author:** [@Rajnish\_Giri](https://discuss.elastic.co/u/Rajnish_Giri)\ **Replies:** 0\ **Last updated:** [January 28, 2020, 7:16am UTC](https://discuss.elastic.co/t/logstash-6-8-4-crashing-while-scheduling-job-from-crontab/216766 "2020-01-28T07:16:41Z")
I am pulling data from multiple s3 buckets using s3 input plugin. While I am running job manually from terminal, it executed successfully, but when i schedule it to run from crontab it's throwing following error: \[2020-… --- ## [Get search results count using Elasticsearch input plugin](https://discuss.elastic.co/t/get-search-results-count-using-elasticsearch-input-plugin/216762)
**Author:** [@saijana](https://discuss.elastic.co/u/saijana)\ **Replies:** 0\ **Last updated:** [January 28, 2020, 6:31am UTC](https://discuss.elastic.co/t/get-search-results-count-using-elasticsearch-input-plugin/216762 "2020-01-28T06:31:38Z")
Hi, Is it possible to get the count of the query using elasticsearch input plugin. elasticsearch { hosts =\> "local:9200" index =\> "test\*" size =\> 500 scroll =\> "2m" } --- ## [Logstash status: Failed to start logstash](https://discuss.elastic.co/t/logstash-status-failed-to-start-logstash/216065)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 9\ **Last updated:** [January 28, 2020, 3:37am UTC](https://discuss.elastic.co/t/logstash-status-failed-to-start-logstash/216065 "2020-01-28T03:37:53Z")
logstash failed to start. I am using logstash7 .2.0 Elasticsearch-7.2.0 Java-11.0.6 When I check the status after starting it shows Active:Failed. $: systemctl status logstash.service â logstash.service - logstas… --- ## [Unable to convert date from string/ change @timestamp value](https://discuss.elastic.co/t/unable-to-convert-date-from-string-change-timestamp-value/216394)
**Author:** [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Replies:** 14\ **Last updated:** [January 28, 2020, 1:00am UTC](https://discuss.elastic.co/t/unable-to-convert-date-from-string-change-timestamp-value/216394 "2020-01-28T01:00:58Z")
I've tried everything i found on the forum but nothing helps, i hope someone could kindly share their experiences with me. newts 2019-12-01 00:19:03 here is my log config trying to change @timestamp value doesnt wor… --- ## [Short\_message and host must be set](https://discuss.elastic.co/t/short-message-and-host-must-be-set/216709)
**Author:** [@sblancocr](https://discuss.elastic.co/u/sblancocr)\ **Replies:** 1\ **Last updated:** [January 27, 2020, 6:10pm UTC](https://discuss.elastic.co/t/short-message-and-host-must-be-set/216709 "2020-01-27T18:10:35Z")
Hi.. I have a logstash and i try to connect to graylog2. The logstash configuration is: input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/XXXX.crt" ssl\_key =\> "/etc/pki/tls/private/Y… --- ## [CSV filter duplicate output result](https://discuss.elastic.co/t/csv-filter-duplicate-output-result/216521)
**Author:** [@pierrejutard](https://discuss.elastic.co/u/pierrejutard)\ **Replies:** 6\ **Last updated:** [January 27, 2020, 5:59pm UTC](https://discuss.elastic.co/t/csv-filter-duplicate-output-result/216521 "2020-01-27T17:59:58Z")
Hello, Under windows 10, with 7.5.2 ES stack version, I try to make a pipeline from a csv file (";") delimiter to ES but the output is not stable. For instance it duplicates the result: The output is:{ "twod" =\> 0.… --- ## [Retrieve Hour and Day from Timestamp](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 3\ **Last updated:** [January 27, 2020, 4:10pm UTC](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093 "2020-01-27T16:10:05Z")
Hello! My code here is getting the hour and day from a newly (and more accurate) timestamp. The timestamp is updated with a -0600 for the timezone. When I retrieve the hour from this timestamp, it doesn't include the fa… --- ## [How to combine oracle db and logfile to get output in kibana using logstash](https://discuss.elastic.co/t/how-to-combine-oracle-db-and-logfile-to-get-output-in-kibana-using-logstash/216693)
**Author:** [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\ **Replies:** 0\ **Last updated:** [January 27, 2020, 4:09pm UTC](https://discuss.elastic.co/t/how-to-combine-oracle-db-and-logfile-to-get-output-in-kibana-using-logstash/216693 "2020-01-27T16:09:35Z")
my question is possible for oracle database and logfile data into same indexpattern like multiple input and single output im tried but logfile data cant be readed --- ## [How to check if the field exists before to define him as geoppoint](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871)
**Author:** [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\ **Replies:** 6\ **Last updated:** [January 27, 2020, 3:06pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871 "2020-01-27T15:06:59Z")
Hello, I use Filebeats, Logstash and Elasticsearch to parse differents types of logs files ( IIS, Syslog, Apache, ... ) and watch the result with Kibana. I want to add a map on my dashboard so I use geoip to get gps coo… --- ## [Geo\_point for conection map](https://discuss.elastic.co/t/geo-point-for-conection-map/215363)
**Author:** [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\ **Replies:** 2\ **Last updated:** [January 27, 2020, 3:42pm UTC](https://discuss.elastic.co/t/geo-point-for-conection-map/215363 "2020-01-27T15:42:46Z")
I am currently mapping the data of a snort, but I was trying to convert two fields, which are the IP source and destination to geo\_point. I am doing this in order to be able to create the map connection visualization. O… --- ## [Logstash not erroring or crashing but not working](https://discuss.elastic.co/t/logstash-not-erroring-or-crashing-but-not-working/216682)
**Author:** [@morpheus](https://discuss.elastic.co/u/morpheus)\ **Replies:** 0\ **Last updated:** [January 27, 2020, 3:21pm UTC](https://discuss.elastic.co/t/logstash-not-erroring-or-crashing-but-not-working/216682 "2020-01-27T15:21:15Z")
I am running Logstash with the command: /usr/share/logstash/bin/logstash --debug "--path.settings" "/etc/logstash2" And getting this DEBUG message \[2020-01-27T15:15:30,902\]\[INFO \]\[logstash.agent \] Successfu… --- ## [Ip2proxy plugin not working](https://discuss.elastic.co/t/ip2proxy-plugin-not-working/216645)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [January 27, 2020, 2:47pm UTC](https://discuss.elastic.co/t/ip2proxy-plugin-not-working/216645 "2020-01-27T14:47:36Z")
Hi, I have ELK Stack v 7.4.2, I get the client ip with %{IP:clientip} in grok filter. I've already installed ip2proxy plugin in logstash. I added this part to logstash filter: ip2proxy { source =\> "clientip" } but in… --- ## [Getting Same Logs while having different ports](https://discuss.elastic.co/t/getting-same-logs-while-having-different-ports/216642)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 1\ **Last updated:** [January 27, 2020, 2:41pm UTC](https://discuss.elastic.co/t/getting-same-logs-while-having-different-ports/216642 "2020-01-27T14:41:57Z")
I have two logstash conf files. First one is for filebeat. input { beats { port =\> 5044 } } filter{ ...... } } and the other one is for awx: input { tcp { host =\> "10.35.110.86" port =\> 3310 } } But i am… --- ## [File\_completed\_action delete not working for gzip files](https://discuss.elastic.co/t/file-completed-action-delete-not-working-for-gzip-files/216661)
**Author:** [@hukel](https://discuss.elastic.co/u/hukel)\ **Replies:** 0\ **Last updated:** [January 27, 2020, 1:32pm UTC](https://discuss.elastic.co/t/file-completed-action-delete-not-working-for-gzip-files/216661 "2020-01-27T13:32:35Z")
When I read .gz log files, the files are not being deleted after being read. When I use an uncompressed file it seems to delete correctly. logstash-input-file (4.1.11) logstash-7.4.2 input { file { path =\> "/… --- ## [Logstash don't delete Files](https://discuss.elastic.co/t/logstash-dont-delete-files/215127)
**Author:** [@Ramon\_Mateo](https://discuss.elastic.co/u/Ramon_Mateo)\ **Replies:** 0\ **Last updated:** [January 15, 2020, 11:54am UTC](https://discuss.elastic.co/t/logstash-dont-delete-files/215127 "2020-01-15T11:54:09Z")
Hi I have added the field "file\_completed\_action=\> "delete" but logstash don't delete files. This is my logstash.conf and docker-compose input { file { path =\> "/usr/share/logstash/inputlogs/\*.csv" start\_position… --- ## [Getting exception in threads dump and cpu consuming high in logstash 5.0?](https://discuss.elastic.co/t/getting-exception-in-threads-dump-and-cpu-consuming-high-in-logstash-5-0/216644)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 0\ **Last updated:** [January 27, 2020, 11:09am UTC](https://discuss.elastic.co/t/getting-exception-in-threads-dump-and-cpu-consuming-high-in-logstash-5-0/216644 "2020-01-27T11:09:06Z")
Please let me know, why is this behabiour occuring? Threads dump; "Ruby-0-Thread-40: /home/local1/monitors/local/localagent/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/server.rb:296" #89 daemon prio=5 os\_pri… --- ## [Why cpu going high when we run logstash 5.0 in server?](https://discuss.elastic.co/t/why-cpu-going-high-when-we-run-logstash-5-0-in-server/216643)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 0\ **Last updated:** [January 27, 2020, 11:06am UTC](https://discuss.elastic.co/t/why-cpu-going-high-when-we-run-logstash-5-0-in-server/216643 "2020-01-27T11:06:18Z")
please help me ? "Ruby-0-Thread-40: /home/local1/monitors/local/localagent/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/server.rb:296" #89 daemon prio=5 os\_prio=0 tid=0x00007f5c20008800 nid=0x2550 runnable \[0x… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=412) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=414)