# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=425 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 426 --- ## [Logstash node not sending to elasticsearch node](https://discuss.elastic.co/t/logstash-node-not-sending-to-elasticsearch-node/213489)
**Author:** [@smaxxx](https://discuss.elastic.co/u/smaxxx)\ **Replies:** 5\ **Last updated:** [January 3, 2020, 4:30pm UTC](https://discuss.elastic.co/t/logstash-node-not-sending-to-elasticsearch-node/213489 "2020-01-03T16:30:45Z")
Hello, so after performance problems. we decided to split logstash and elasticsearch up in separate nodes. However, the logstash node isn't sending anything to the elasticsearch node. Here are my findings so far: Can t… --- ## [Grok help with cisco firepower 2130](https://discuss.elastic.co/t/grok-help-with-cisco-firepower-2130/211465)
**Author:** [@Aashish\_Arora](https://discuss.elastic.co/u/Aashish_Arora)\ **Replies:** 3\ **Last updated:** [January 3, 2020, 3:41pm UTC](https://discuss.elastic.co/t/grok-help-with-cisco-firepower-2130/211465 "2020-01-03T15:41:40Z")
Hello, I'm new to grok i want to put cisco fire power 2130 logs to elasticsearch I'm getting 6 types of different log lines so how do i write grok filter I'd created 6 different grok filter and checked by grok debugge… --- ## [AWS ELK : Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError"](https://discuss.elastic.co/t/aws-elk-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror/213691)
**Author:** [@gyana\_nayak](https://discuss.elastic.co/u/gyana_nayak)\ **Replies:** 2\ **Last updated:** [January 3, 2020, 12:52pm UTC](https://discuss.elastic.co/t/aws-elk-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror/213691 "2020-01-03T12:52:20Z")
Hi All, Getting LogStash::ConfigurationError in AWS ELK environment. below is my logstash file input { file { type =\> "audit" path =\> \["/var/log/tomcat8/\*\*/\*-audit.log"\] start… --- ## [Grok parse failure ensist](https://discuss.elastic.co/t/grok-parse-failure-ensist/213698)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [January 3, 2020, 12:02pm UTC](https://discuss.elastic.co/t/grok-parse-failure-ensist/213698 "2020-01-03T12:02:53Z")
Hello, I am trying to parse the following log. My purpose is to take the number 4 field that is highlighted in the vertical red rectangle The exact log message to be parsed is this one: C:\\Program Files (x86)\\Always… --- ## [Pipeline disabling](https://discuss.elastic.co/t/pipeline-disabling/213604)
**Author:** [@pchakour](https://discuss.elastic.co/u/pchakour)\ **Replies:** 1\ **Last updated:** [January 3, 2020, 10:37am UTC](https://discuss.elastic.co/t/pipeline-disabling/213604 "2020-01-03T10:37:24Z")
Hello ! I'm currently working on the logstash 7.5.1. I'm using the multiple pipelines file with the auto reload mode to create and delete pipelines when logstash is running. I noticed that Logstash doesn't create a p… --- ## [Unable to index csv to elasticsearch (MalformedCSVError: Unclosed quoted field)](https://discuss.elastic.co/t/unable-to-index-csv-to-elasticsearch-malformedcsverror-unclosed-quoted-field/211422)
**Author:** [@SHUBHAM\_KADAM](https://discuss.elastic.co/u/SHUBHAM_KADAM)\ **Replies:** 4\ **Last updated:** [January 3, 2020, 9:01am UTC](https://discuss.elastic.co/t/unable-to-index-csv-to-elasticsearch-malformedcsverror-unclosed-quoted-field/211422 "2020-01-03T09:01:03Z")
Hi, I have been trying to index csv file to elasticsearch using logstash. But, due to issue related to the csv file, I am unable to do so. Sample data: file,id,Last-Updated,SubmittedOn,Engg,Des /path/to/file.c,id21,4… --- ## [Logstash JDBC Plugin Cassandra, Maria Driver Not Working](https://discuss.elastic.co/t/logstash-jdbc-plugin-cassandra-maria-driver-not-working/213555)
**Author:** [@sharath\_sai](https://discuss.elastic.co/u/sharath_sai)\ **Replies:** 0\ **Last updated:** [January 2, 2020, 10:37am UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-cassandra-maria-driver-not-working/213555 "2020-01-02T10:37:54Z")
I am Working on Logstash input Jdbc with different databases, Primarily I am trying for cassandra and I am using DBSchema driver, the driver is properly working with my java jdbc code, but when coming integrate with Logs… --- ## [Parsing special charaters with grok](https://discuss.elastic.co/t/parsing-special-charaters-with-grok/213548)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 2\ **Last updated:** [January 3, 2020, 6:07am UTC](https://discuss.elastic.co/t/parsing-special-charaters-with-grok/213548 "2020-01-03T06:07:56Z")
My log file contains lines in below format: cat -A test3\_client1\_out-0.log \[2020-01-02 12:38:33.378\] ^\[\[32mINFO ^\[\[39m: ^\[\[36m\ success member\<232687\>^\[\[39m$ \[2020-01-02 11:55:05.698\] ^\[\[32mINFO ^\[\[39m: ^\[\[36m\ **Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 0\ **Last updated:** [January 3, 2020, 3:56am UTC](https://discuss.elastic.co/t/extract-date-from-log-message-logstash/213648 "2020-01-03T03:56:52Z") Hi, I have this situation where I have installed filebeat in a server to monitor OASIS application logs. Their log is not very constant and has multiple formats across 100 files. Is there a way to pickup the time of t… --- ## [Convert timezone of @timestamp field](https://discuss.elastic.co/t/convert-timezone-of-timestamp-field/212703)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [January 2, 2020, 8:41pm UTC](https://discuss.elastic.co/t/convert-timezone-of-timestamp-field/212703 "2020-01-02T20:41:20Z")
I need to do this because we are putting all out index with Etc/UTC timezone and setting up all user on kibana with Etc/UTC timezone. that way when use login to kibana they see data on proper time when we run sql quer… --- ## [Migrate my elasticsearch data to an SQL database with Logstash](https://discuss.elastic.co/t/migrate-my-elasticsearch-data-to-an-sql-database-with-logstash/213625)
**Author:** [@Elvis\_Goncalves](https://discuss.elastic.co/u/Elvis_Goncalves)\ **Replies:** 0\ **Last updated:** [January 2, 2020, 8:38pm UTC](https://discuss.elastic.co/t/migrate-my-elasticsearch-data-to-an-sql-database-with-logstash/213625 "2020-01-02T20:38:00Z")
I need to know how I can put together a configuration file that can consult me ​​all the information about my elastic and can insert it in an SQL. --- ## [Missing libraries while building plugin](https://discuss.elastic.co/t/missing-libraries-while-building-plugin/213612)
**Author:** [@Brian\_Seel](https://discuss.elastic.co/u/Brian_Seel)\ **Replies:** 0\ **Last updated:** [January 2, 2020, 6:20pm UTC](https://discuss.elastic.co/t/missing-libraries-while-building-plugin/213612 "2020-01-02T18:20:23Z")
I need to use sqlite in my ruby filter (so not the sqlite logstash plugin, but the ruby gem). I am following the directions for building and installing a ruby gem from the logstash plugin documentation, but I seem to be … --- ## [How to bind to loopback address with docker](https://discuss.elastic.co/t/how-to-bind-to-loopback-address-with-docker/213610)
**Author:** [@bclipp770](https://discuss.elastic.co/u/bclipp770)\ **Replies:** 0\ **Last updated:** [January 2, 2020, 6:19pm UTC](https://discuss.elastic.co/t/how-to-bind-to-loopback-address-with-docker/213610 "2020-01-02T18:19:53Z")
I'm trying to run logstash using docker (with or without compose). I have set network.publish\_host=127.0.0.1 but I still get the following: logstash\_1 | {"type": "server", "level": "INFO", "component": "o.e.t.Transp… --- ## [Java::oracle.jdbc.driver.OracleDriver not loaded in logstash-7.2.0](https://discuss.elastic.co/t/java-oracle-jdbc-driver-oracledriver-not-loaded-in-logstash-7-2-0/213522)
**Author:** [@Pramod\_Thakur](https://discuss.elastic.co/u/Pramod_Thakur)\ **Replies:** 1\ **Last updated:** [January 2, 2020, 4:02pm UTC](https://discuss.elastic.co/t/java-oracle-jdbc-driver-oracledriver-not-loaded-in-logstash-7-2-0/213522 "2020-01-02T16:02:08Z")
Hi, I am using logstash-7.2.0. I want to export data from oracle to ES. I am having following configuration. input { jdbc{ jdbc\_driver\_library =\> "C:/Pramod/rnd/ElasticSearch/logstash-7.2.0/ojdbc7.jar" jdbc\_driver\_cl… --- ## [ELK stack with filebeat not mapping well GeoIP data](https://discuss.elastic.co/t/elk-stack-with-filebeat-not-mapping-well-geoip-data/213585)
**Author:** [@alesanchez](https://discuss.elastic.co/u/alesanchez)\ **Replies:** 5\ **Last updated:** [January 2, 2020, 3:54pm UTC](https://discuss.elastic.co/t/elk-stack-with-filebeat-not-mapping-well-geoip-data/213585 "2020-01-02T15:54:15Z")
Hello everyone, I want to view the data regarding nginx logs in Kibana so I've set up a flow that looks like: Filebeat \> Logstash \> Elasticsearch Filebeat is in the same machine as the nginx I want the logs from and L… --- ## [Logstash.agent successfully started logstash enpoint port 9600](https://discuss.elastic.co/t/logstash-agent-successfully-started-logstash-enpoint-port-9600/213542)
**Author:** [@Yasso](https://discuss.elastic.co/u/Yasso)\ **Replies:** 6\ **Last updated:** [January 2, 2020, 3:33pm UTC](https://discuss.elastic.co/t/logstash-agent-successfully-started-logstash-enpoint-port-9600/213542 "2020-01-02T15:33:30Z")
hello guys i'm facing a problem .. logstrash can not load data to elasticsearch i'm using my own config file ..and it seems ok for me ..when i run it ..it shows no error but the end point is port 9600 instead of 9200 … --- ## [Logstash\_KVFilter](https://discuss.elastic.co/t/logstash-kvfilter/211605)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 2\ **Last updated:** [January 2, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logstash-kvfilter/211605 "2020-01-02T14:56:49Z")
Hi There, Am trying to split the fileds and values of this field winlog.event\_data.RuleName: technique\_id=T1036,technique\_name=Masquerading in two other separate fields where I can have technique id separately and tec… --- ## [Logstash ignore logs grok filter](https://discuss.elastic.co/t/logstash-ignore-logs-grok-filter/213578)
**Author:** [@Aayush\_Agrawal](https://discuss.elastic.co/u/Aayush_Agrawal)\ **Replies:** 1\ **Last updated:** [January 2, 2020, 2:02pm UTC](https://discuss.elastic.co/t/logstash-ignore-logs-grok-filter/213578 "2020-01-02T14:02:19Z")
I want to capture the start time of a log, but if i use grok filter if there are some log with same info they all will be captured. How do i modify the filter as such it ignore rest of the logs with same pattern as soon … --- ## [Parse http filter plugin response](https://discuss.elastic.co/t/parse-http-filter-plugin-response/213580)
**Author:** [@Ankush\_Jadhav](https://discuss.elastic.co/u/Ankush_Jadhav)\ **Replies:** 0\ **Last updated:** [January 2, 2020, 1:32pm UTC](https://discuss.elastic.co/t/parse-http-filter-plugin-response/213580 "2020-01-02T13:32:04Z")
Hi, I am using the logstash http filter plugin to fetch some data from an external webservice. This webservice returns a JSON object in the response body. I want to extract the values from this JSON response and add th… --- ## [Logstash csv - Filters only rows with specific column count](https://discuss.elastic.co/t/logstash-csv-filters-only-rows-with-specific-column-count/213569)
**Author:** [@Lubos\_Marek](https://discuss.elastic.co/u/Lubos_Marek)\ **Replies:** 1\ **Last updated:** [January 2, 2020, 1:08pm UTC](https://discuss.elastic.co/t/logstash-csv-filters-only-rows-with-specific-column-count/213569 "2020-01-02T13:08:51Z")
Hello, I have a log file (\*.csv) with this specifific structure datetime;level; statuscode; message Sometimes missing the "statuscode" and that row has only 3 columns (datetime;level;message). Can I somehow skip rows… --- ## [Datetime conversion error Logsatsh](https://discuss.elastic.co/t/datetime-conversion-error-logsatsh/213319)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 14\ **Last updated:** [January 2, 2020, 5:12am UTC](https://discuss.elastic.co/t/datetime-conversion-error-logsatsh/213319 "2020-01-02T05:12:50Z")
Hi Im having the below configuration in my logstash filter { xml { source =\> "result" target =\> "Incident" force\_array =\> false } date{ match =\> \[ "sys\_created\_on","yyyy-MM-dd HH:mm:ss"… --- ## [How to update index?](https://discuss.elastic.co/t/how-to-update-index/213550)
**Author:** [@volcano](https://discuss.elastic.co/u/volcano)\ **Replies:** 0\ **Last updated:** [January 2, 2020, 10:08am UTC](https://discuss.elastic.co/t/how-to-update-index/213550 "2020-01-02T10:08:04Z")
I have this output plugin in Logstash to create elastic search index. output { amazon\_es { hosts =\> \["https://xxxxxxxxxxxxxxxx.es.amazonaws.com/"\] region =\> "ap-southeast-1" index =\> "studentser… --- ## [Error manage template](https://discuss.elastic.co/t/error-manage-template/213535)
**Author:** [@gcian](https://discuss.elastic.co/u/gcian)\ **Replies:** 1\ **Last updated:** [January 2, 2020, 8:34am UTC](https://discuss.elastic.co/t/error-manage-template/213535 "2020-01-02T08:34:38Z")
hi, i'm pretty new on elastic and i don't find the solution of my problem. I try to push a template to elastic with logstash because i want certain data to be formated with the IP type, but i've got a message that say … --- ## [Logstash fails to run by exception (EINVAL) Invalid argument - /usr/share/logstash/vendor/bundle/jruby/2.5.0/specifications/simple\_oauth-0.3.1.gemspec](https://discuss.elastic.co/t/logstash-fails-to-run-by-exception-einval-invalid-argument-usr-share-logstash-vendor-bundle-jruby-2-5-0-specifications-simple-oauth-0-3-1-gemspec/213521)
**Author:** [@Ajmeera\_Suresh](https://discuss.elastic.co/u/Ajmeera_Suresh)\ **Replies:** 0\ **Last updated:** [January 2, 2020, 7:17am UTC](https://discuss.elastic.co/t/logstash-fails-to-run-by-exception-einval-invalid-argument-usr-share-logstash-vendor-bundle-jruby-2-5-0-specifications-simple-oauth-0-3-1-gemspec/213521 "2020-01-02T07:17:53Z")
Hi All I have followed almost every link in this community and all over, still not able to get Cassandra data to logstash using jdbc input plugin. I have downloaded cassandraJdbcDriver.zip from DBSchema. and unzip the … --- ## [Why input plugin "file" doesn't read lines in sequence?](https://discuss.elastic.co/t/why-input-plugin-file-doesnt-read-lines-in-sequence/213476)
**Author:** [@jmliu1983](https://discuss.elastic.co/u/jmliu1983)\ **Replies:** 6\ **Last updated:** [January 2, 2020, 7:24am UTC](https://discuss.elastic.co/t/why-input-plugin-file-doesnt-read-lines-in-sequence/213476 "2020-01-02T07:24:55Z")
Thanks a lot for taking your time read my topic. When I use "file" input plugin to read the following csv file, I found it doesn't always read lines in sequence. (My purpose is check if the value of field "Sensornr" in… --- ## [Logstash support redis cluster](https://discuss.elastic.co/t/logstash-support-redis-cluster/213492)
**Author:** [@mingbei.xu](https://discuss.elastic.co/u/mingbei.xu)\ **Replies:** 0\ **Last updated:** [January 1, 2020, 3:42pm UTC](https://discuss.elastic.co/t/logstash-support-redis-cluster/213492 "2020-01-01T15:42:44Z")
1、update redis-rb version to 4.1.3 2、update /vendor/bundle/jruby/2.3.0/gemslogstash-output-redis-4.0.4/lib /logstash/outputs/redis.rb #if not @current\_port # @current\_port = @port #end #params = { # :host =\> @curren… --- ## [Not Able to load data in ElasticSearch](https://discuss.elastic.co/t/not-able-to-load-data-in-elasticsearch/213328)
**Author:** [@Saurabh\_Jain](https://discuss.elastic.co/u/Saurabh_Jain)\ **Replies:** 2\ **Last updated:** [January 1, 2020, 8:59am UTC](https://discuss.elastic.co/t/not-able-to-load-data-in-elasticsearch/213328 "2020-01-01T08:59:57Z")
Hi, I am trying to upload data via logstash in ElasticSearch but somehow not able to do. Could you pls chk the conf file and logstash logs and suggest for the same. input { file { path =\> "C:\\Users\\SaurabhJain\\Deskt… --- ## [How to rectify wrong UTC offset value](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331)
**Author:** [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Replies:** 3\ **Last updated:** [January 1, 2020, 2:21am UTC](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331 "2020-01-01T02:21:14Z")
Hi, I sending my Symantec proxy (Bluecoat) logs to ELK stack. The date formats is as follows "\[dd/MMM/YYYY:HH:mm:ss Z\]" "\[30/Dec/2019:15:34:11 +0550\]" Unfortunately due to a bug in current SGOS (proxy firmware) versi… --- ## [Logstash internal monitoring not sending any info](https://discuss.elastic.co/t/logstash-internal-monitoring-not-sending-any-info/213388)
**Author:** [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\ **Replies:** 6\ **Last updated:** [December 31, 2019, 7:28pm UTC](https://discuss.elastic.co/t/logstash-internal-monitoring-not-sending-any-info/213388 "2019-12-31T19:28:18Z")
Hi, I've setup Elasticsearch, Kibana and Logstash using https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html I activated monitoring from Kibana monitoring UI. then I tried configuring th… --- ## [Logstash convert String into milliseconds](https://discuss.elastic.co/t/logstash-convert-string-into-milliseconds/213398)
**Author:** [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\ **Replies:** 4\ **Last updated:** [December 31, 2019, 7:00pm UTC](https://discuss.elastic.co/t/logstash-convert-string-into-milliseconds/213398 "2019-12-31T19:00:47Z")
Hi, I am using logstash to convert below two strings into integer and then converting integer to milliseconds. i have nginx logs with below values request\_time="0.051" response\_time="0.027" first i am converting the… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=424) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=426)