# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=441 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 442 --- ## [Create Index Name in Logstash based on event fields](https://discuss.elastic.co/t/create-index-name-in-logstash-based-on-event-fields/209443)
**Author:** [@Simon\_Becker](https://discuss.elastic.co/u/Simon_Becker)\ **Replies:** 0\ **Last updated:** [November 26, 2019, 8:07am UTC](https://discuss.elastic.co/t/create-index-name-in-logstash-based-on-event-fields/209443 "2019-11-26T08:07:43Z")
Hello, i try to create an index name based on fields I added in my beat.yml. I added a customer field in my beats.yml: processors: - add\_fields: target: customer fields: name: testcustomer Now I would like to c… --- ## [How to remove winlogbeat.yml.new file modification logs?](https://discuss.elastic.co/t/how-to-remove-winlogbeat-yml-new-file-modification-logs/209422)
**Author:** [@Ranger\_blue](https://discuss.elastic.co/u/Ranger_blue)\ **Replies:** 0\ **Last updated:** [November 26, 2019, 6:11am UTC](https://discuss.elastic.co/t/how-to-remove-winlogbeat-yml-new-file-modification-logs/209422 "2019-11-26T06:11:38Z")
Hi Everyone, I'm getting the following message in logstash directory=C:\\ProgramData\\winlogbeat.winlogbeat.yml.new timestamp=2019-11-26 08:02:14.213000 event=file deleted hostname=test username=test directory=C:\\Program… --- ## [Read remote file using file input](https://discuss.elastic.co/t/read-remote-file-using-file-input/207218)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 7\ **Last updated:** [November 26, 2019, 5:47am UTC](https://discuss.elastic.co/t/read-remote-file-using-file-input/207218 "2019-11-26T05:47:49Z")
Hi, I want to read a remote file using input plugin but I am not able to find how to read it. Can you pls let me know if there is any way to read remote file through file or some other plugin. PS: I do not want to in… --- ## [Don’t forget the space after colon in translate dictionary](https://discuss.elastic.co/t/don-t-forget-the-space-after-colon-in-translate-dictionary/209408)
**Author:** [@dpresbit](https://discuss.elastic.co/u/dpresbit)\ **Replies:** 0\ **Last updated:** [November 26, 2019, 3:39am UTC](https://discuss.elastic.co/t/don-t-forget-the-space-after-colon-in-translate-dictionary/209408 "2019-11-26T03:39:13Z")
Spent quite a bit of time today scratching my head with a translate filter / dictionary\_path issue. Resolution was to ensure that my keys had a colon with a space immediately after it, before the value was entered. Con… --- ## [Logstash lost data when using file input plugin](https://discuss.elastic.co/t/logstash-lost-data-when-using-file-input-plugin/209406)
**Author:** [@bigben](https://discuss.elastic.co/u/bigben)\ **Replies:** 0\ **Last updated:** [November 26, 2019, 3:28am UTC](https://discuss.elastic.co/t/logstash-lost-data-when-using-file-input-plugin/209406 "2019-11-26T03:28:46Z")
Hi all, I use the logstash file input plugin, and data lost occur. Every 1 hour, download log files to the path ("/path/to/.../.log."), and I use the logstash file input plugin to tail them. When Logstash started, it … --- ## [Logstash7.4.2 shutsdown when run from command line attached to elastic search](https://discuss.elastic.co/t/logstash7-4-2-shutsdown-when-run-from-command-line-attached-to-elastic-search/209166)
**Author:** [@prashant\_kulkarni](https://discuss.elastic.co/u/prashant_kulkarni)\ **Replies:** 2\ **Last updated:** [November 25, 2019, 11:34pm UTC](https://discuss.elastic.co/t/logstash7-4-2-shutsdown-when-run-from-command-line-attached-to-elastic-search/209166 "2019-11-25T23:34:20Z")
New to using Elastic search and logstash. I installed elasticsearch and logstash on windows. Started Elasticsearch on localhost without any issues. I was able to get the response at port 9200 as expected. I installed lo… --- ## [Unable to access in kibana through logstash](https://discuss.elastic.co/t/unable-to-access-in-kibana-through-logstash/209363)
**Author:** [@rmahi](https://discuss.elastic.co/u/rmahi)\ **Replies:** 2\ **Last updated:** [November 25, 2019, 8:57pm UTC](https://discuss.elastic.co/t/unable-to-access-in-kibana-through-logstash/209363 "2019-11-25T20:57:25Z")
Hi there, I got this problem that shows here's no file in s3 bucket. For this reason im not see my logs in Kibana. Can any one know how can i solve it pls? .com logstash\[26754\]: \[2019-11-25T19:26:23,784\]\[INFO \]\[logstash… --- ## [Uninitialized constant LogStash::Filters::CIDR::IPAddr](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 4\ **Last updated:** [November 25, 2019, 7:10pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337 "2019-11-25T19:10:39Z")
Hi All, For some reason I am getting the below error. I have checked my CIDR config and the appear correct to me. I do several CIDR checks like below where I set different tags and use different networks. Can someone p… --- ## [Changing xml console output](https://discuss.elastic.co/t/changing-xml-console-output/209356)
**Author:** [@kcb](https://discuss.elastic.co/u/kcb)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 6:26pm UTC](https://discuss.elastic.co/t/changing-xml-console-output/209356 "2019-11-25T18:26:20Z")
We have a logstash script that successfully parses xml files. Our output displays in format: geo =\> { "service" =\> "abc" "version: =\> "1.1.1" ... } Is it possible to get rid of the "geo" in the display, so the disp… --- ## [Use logstash\_checksum as tracking\_column](https://discuss.elastic.co/t/use-logstash-checksum-as-tracking-column/209269)
**Author:** [@WalterLeff](https://discuss.elastic.co/u/WalterLeff)\ **Replies:** 8\ **Last updated:** [November 25, 2019, 4:51pm UTC](https://discuss.elastic.co/t/use-logstash-checksum-as-tracking-column/209269 "2019-11-25T16:51:22Z")
Hi all Logstash creates perfectly a checksum from my row data { "\_index": "rel", "\_type": "\_doc", "\_id": "2", "\_version": 5, "\_score": 0, "\_source": { "datecreated": "2016-06-09T00:00:00.000Z", … --- ## [Pipeline Filtering - Add Tags Help](https://discuss.elastic.co/t/pipeline-filtering-add-tags-help/209116)
**Author:** [@TFresenius](https://discuss.elastic.co/u/TFresenius)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 4:46pm UTC](https://discuss.elastic.co/t/pipeline-filtering-add-tags-help/209116 "2019-11-25T16:46:55Z")
Hello. I'm attempting to create custom tags on individual hosts by editing the logstash pipeline. I have attempted to use this: filter{ if \[agent\]\[hostname\] == "Host100"{ mutate { add\_… --- ## [Don't know how to make elasticsearch recognise the location coordenates properly for Map "visualitzation" on Kibana](https://discuss.elastic.co/t/dont-know-how-to-make-elasticsearch-recognise-the-location-coordenates-properly-for-map-visualitzation-on-kibana/207113)
**Author:** [@HikariNTB](https://discuss.elastic.co/u/HikariNTB)\ **Replies:** 3\ **Last updated:** [November 25, 2019, 4:01pm UTC](https://discuss.elastic.co/t/dont-know-how-to-make-elasticsearch-recognise-the-location-coordenates-properly-for-map-visualitzation-on-kibana/207113 "2019-11-25T16:01:58Z")
Hi, Recently, I had to face a project where I had to locate on a map the different issues we have. I've been trying for a week how to do it with logstash but I don't know why is not working... Here you have my ".conf"… --- ## [Why the host mapping is not wokring](https://discuss.elastic.co/t/why-the-host-mapping-is-not-wokring/209140)
**Author:** [@SathishPrakasam](https://discuss.elastic.co/u/SathishPrakasam)\ **Replies:** 3\ **Last updated:** [November 25, 2019, 3:09pm UTC](https://discuss.elastic.co/t/why-the-host-mapping-is-not-wokring/209140 "2019-11-25T15:09:23Z")
Hi Team, Need clarification on why this mapping is not working. Logstash field, "host" =\> "vzon-pdm-prod.gnm.dns.denc.nka.net" Template mapping: "host": {"type": "keyword" } Its throwing below error while sending m… --- ## [Logstash skip records by adding latest updated record date in last run metadata file](https://discuss.elastic.co/t/logstash-skip-records-by-adding-latest-updated-record-date-in-last-run-metadata-file/209309)
**Author:** [@saifrehman](https://discuss.elastic.co/u/saifrehman)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 1:28pm UTC](https://discuss.elastic.co/t/logstash-skip-records-by-adding-latest-updated-record-date-in-last-run-metadata-file/209309 "2019-11-25T13:28:01Z")
My goal is to set up continuous data migration from MySQL to Elasticsearch. Everything is working fine but I've stuck with :sql\_last\_value. My server and database timezone is in UTC format. Problem: When i update 4 to 6… --- ## [Files automatically indexed in elastic](https://discuss.elastic.co/t/files-automatically-indexed-in-elastic/209305)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 12:54pm UTC](https://discuss.elastic.co/t/files-automatically-indexed-in-elastic/209305 "2019-11-25T12:54:04Z")
I have a folder where new logs are added daily, in my conf file the input is defined like this: input { file { path =\> "/opt/processed/disc\*" start\_position =\> "beginning" sincedb… --- ## [Exporting CSV from Logstash with node.js](https://discuss.elastic.co/t/exporting-csv-from-logstash-with-node-js/209295)
**Author:** [@amandeep01](https://discuss.elastic.co/u/amandeep01)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 12:04pm UTC](https://discuss.elastic.co/t/exporting-csv-from-logstash-with-node-js/209295 "2019-11-25T12:04:42Z")
Hello Everyone, I am new to Elasticsearch and Logstash. I am using Elasticsearch to save orders data. Now, I need to export the CSV report from Elasticsearch into my frontend application which is built using angular. I … --- ## [How to add 'key:{a:b,c:d}' by using add\_field](https://discuss.elastic.co/t/how-to-add-key-a-b-c-d-by-using-add-field/209261)
**Author:** [@muguaofyu](https://discuss.elastic.co/u/muguaofyu)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 9:29am UTC](https://discuss.elastic.co/t/how-to-add-key-a-b-c-d-by-using-add-field/209261 "2019-11-25T09:29:15Z")
i want to add 'key:{a:b,c:d}' to es by using add\_field. how to achieve it? i want to see the above. --- ## [How to rename a field after extracting it from another field](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 6\ **Last updated:** [November 25, 2019, 9:14am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050 "2019-11-25T09:14:48Z")
kv { source =\> "remain" field\_split =\> "," value\_split =\> "=" } mutate { rename =\> \["USERNAME", "user.name" \] … --- ## [Extract nested fields into new fields](https://discuss.elastic.co/t/extract-nested-fields-into-new-fields/209026)
**Author:** [@a.kuz](https://discuss.elastic.co/u/a.kuz)\ **Replies:** 5\ **Last updated:** [November 25, 2019, 7:28am UTC](https://discuss.elastic.co/t/extract-nested-fields-into-new-fields/209026 "2019-11-25T07:28:23Z")
Hi! I have json input like: Summary{ "Parameters": \[ { "Name": "SentTo", "Value": "User User" }, { "Name": "BlindCopyTo", "Value": … --- ## [Help needed for field to template date mapping](https://discuss.elastic.co/t/help-needed-for-field-to-template-date-mapping/209120)
**Author:** [@SathishPrakasam](https://discuss.elastic.co/u/SathishPrakasam)\ **Replies:** 1\ **Last updated:** [November 22, 2019, 9:34pm UTC](https://discuss.elastic.co/t/help-needed-for-field-to-template-date-mapping/209120 "2019-11-22T21:34:06Z")
Hi team, My date mapping from logstash, logstash: date { match =\> \[ "logtime" , "yyyy-MM-dd HH:mm:ss" \] timezone =\> UTC } Field mapping in the template: "logtime": {"type": "date","format":"yyyy-MM-dd HH:mm:ss"}… --- ## [LogStash Codec](https://discuss.elastic.co/t/logstash-codec/209210)
**Author:** [@Yohan\_al](https://discuss.elastic.co/u/Yohan_al)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 2:48am UTC](https://discuss.elastic.co/t/logstash-codec/209210 "2019-11-25T02:48:34Z")
Hi, I m facing an issue with a spring boot 2 project and logstash. It seems i use the wrong codec on my TCP configuration. tcp { port =\> 8050 codec =\> "json" } When i checked logstash logs , i see that my log is s… --- ## [Logstash-oss:7.4.0 geoip reports wrong lat/lon](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161)
**Author:** [@Long\_Thai](https://discuss.elastic.co/u/Long_Thai)\ **Replies:** 4\ **Last updated:** [November 24, 2019, 9:48pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161 "2019-11-24T21:48:09Z")
I found some incorrect results when performing geoip of IP addresses through the geoip filter in Logsstash-oss:7.4.0. Two IP address in question are: 171.246.59.245 123.30.237.63 From logstash both IPs have the sam… --- ## [Error while running logstash file](https://discuss.elastic.co/t/error-while-running-logstash-file/209191)
**Author:** [@sandy1](https://discuss.elastic.co/u/sandy1)\ **Replies:** 1\ **Last updated:** [November 24, 2019, 6:18pm UTC](https://discuss.elastic.co/t/error-while-running-logstash-file/209191 "2019-11-24T18:18:17Z")
D:\\logstash-7.4.2\\bin\>logstash -f sample.conf Thread.exclusive is deprecated, use Thread::Mutex Sending Logstash logs to D:/logstash-7.4.2/logs which is now configured via log4j2.properties \[2019-11-24T22:49:41,889\]\[W… --- ## [Grok parse failure en CVS filter?](https://discuss.elastic.co/t/grok-parse-failure-en-cvs-filter/209181)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [November 24, 2019, 2:59pm UTC](https://discuss.elastic.co/t/grok-parse-failure-en-cvs-filter/209181 "2019-11-24T14:59:38Z")
Is there something like grok parse failure in the CVS filter?, if it exist I want to include it in a conditional to output the failures to a file. --- ## [Conditional statement with String](https://discuss.elastic.co/t/conditional-statement-with-string/209179)
**Author:** [@gyana\_nayak](https://discuss.elastic.co/u/gyana_nayak)\ **Replies:** 0\ **Last updated:** [November 24, 2019, 1:24pm UTC](https://discuss.elastic.co/t/conditional-statement-with-string/209179 "2019-11-24T13:24:55Z")
I have below sample log lines in same file 2019-11-23T14:38:43.495 backendorg \[http-nio-8080-exec-45\] INFO http-nio-8080-exec-45 SessionController http://localhost:8080/ABC/session/login abc.nayak@zinier.com backendorg… --- ## [Logstash OSS license features and X-PACK](https://discuss.elastic.co/t/logstash-oss-license-features-and-x-pack/209124)
**Author:** [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)\ **Replies:** 3\ **Last updated:** [November 23, 2019, 8:04pm UTC](https://discuss.elastic.co/t/logstash-oss-license-features-and-x-pack/209124 "2019-11-23T20:04:23Z")
Hi, I am using Logstash OSS, and I want to be sure that I dont use x-pack features without Elastic license. I want to know Can i use TLS between Filebeat - Logstash, with Logstash/Filebeat OSS Apache 2.0. Or I need … --- ## [Logstash-filter-jdbc\_streaming -- parameter issue calling stored procedure (MSSQL)](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-parameter-issue-calling-stored-procedure-mssql/209085)
**Author:** [@Chris\_Lyons](https://discuss.elastic.co/u/Chris_Lyons)\ **Replies:** 1\ **Last updated:** [November 23, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-parameter-issue-calling-stored-procedure-mssql/209085 "2019-11-23T18:41:11Z")
Logstash Version: 6.4 hosted on Oracle Linux Server release 6.8 Database: MSSQL 2017 Running into an issue with the way logstash-filter-jdbc\_streaming adds parameters to statements. I am leveraging a stored procedu… --- ## [Extract only one line of message in logstash](https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 8:25am UTC](https://discuss.elastic.co/t/extract-only-one-line-of-message-in-logstash/209146 "2019-11-23T08:25:38Z")
Hello, I have a message that is in the format 2019-10-22 22:59:56 HOSTNAME \[Error\] Connection id ""ABCDEF"", Request id ""123ABCD"": An unhandled exception was thrown by the application. System.NullReferenceException:… --- ## [Rename snmp dynamic fields](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236)
**Author:** [@richard\_N](https://discuss.elastic.co/u/richard_N)\ **Replies:** 4\ **Last updated:** [November 23, 2019, 1:44am UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236 "2019-11-23T01:44:54Z")
How can I strip off everything after the . in my fields. Using SNMP the field names a very dynamic across devices and interfaces. ifDescr.27 to IfDescr ifInOctects.50 to IfInOctects IfInErrors.19 to IfInErrors --- ## [Logstash OSS contains some dependencies from component containing GPL License](https://discuss.elastic.co/t/logstash-oss-contains-some-dependencies-from-component-containing-gpl-license/209127)
**Author:** [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)\ **Replies:** 0\ **Last updated:** [November 23, 2019, 12:26am UTC](https://discuss.elastic.co/t/logstash-oss-contains-some-dependencies-from-component-containing-gpl-license/209127 "2019-11-23T00:26:05Z")
Hi, I did FOSSA of Logstash 6.6.1 and Logstash-codec-plugin, both these software are under Apache 2.0 License. However both contains sub-components that are GPL, LGPL copyleft license. Fossa scanning reveals Logstash c… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=440) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=442)