# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=443 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 444 --- ## [GROK ASA Issues](https://discuss.elastic.co/t/grok-asa-issues/208914)
**Author:** [@JPetrucka](https://discuss.elastic.co/u/JPetrucka)\ **Replies:** 2\ **Last updated:** [November 21, 2019, 6:55pm UTC](https://discuss.elastic.co/t/grok-asa-issues/208914 "2019-11-21T18:55:17Z")
Hey everyone, I am a logstash/grok beginner and would love some help parsing my syslog from our ASA to create some tags. I have tried both the grok debugger on herokuapp and the dev tools in Kibana without luck. My sysl… --- ## [How do you do multiple "OR"s in a filter?](https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 2\ **Last updated:** [November 21, 2019, 4:13pm UTC](https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922 "2019-11-21T16:13:20Z")
Hi, I currently have a filter with nine "or" statements that look for a few different strings in log messages, then applies a tag. I tried a regex similar to this, but it wasn't matching on anything: if "(foo|bar|foob… --- ## [Indices names missing timestamp](https://discuss.elastic.co/t/indices-names-missing-timestamp/208730)
**Author:** [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\ **Replies:** 3\ **Last updated:** [November 21, 2019, 3:59pm UTC](https://discuss.elastic.co/t/indices-names-missing-timestamp/208730 "2019-11-21T15:59:36Z")
elasticsearch index name is not created correctly, here is the logstash config: output { #stdout { codec =\> rubydebug } elasticsearch { hosts =\> "es.example.com:443" ssl =\> true ssl\_certificate\_verifi… --- ## [Simple question with send java log to logstash via tcp](https://discuss.elastic.co/t/simple-question-with-send-java-log-to-logstash-via-tcp/208911)
**Author:** [@Diego\_Lopes](https://discuss.elastic.co/u/Diego_Lopes)\ **Replies:** 0\ **Last updated:** [November 21, 2019, 2:44pm UTC](https://discuss.elastic.co/t/simple-question-with-send-java-log-to-logstash-via-tcp/208911 "2019-11-21T14:44:05Z")
I need to send logs from a java application to logstash, but I can't. What am I doing wrong? input { tcp { port =\> 5555 type =\> "app" } } filter { if \[type\] =… --- ## [Problem with "split" and "add\_field" in mutate filter](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 4\ **Last updated:** [November 21, 2019, 2:26pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883 "2019-11-21T14:26:03Z")
Hello, I have the following log line : "1","O","I","191118 190923","E","0","1455","SFTP","PNVIO111","IT9","/data/files/TRANS","FOPIT901-9281025" And the following dissect filter : dissect { mapping =\> { "message… --- ## [Combining a dat field and a time field into a single timestamp](https://discuss.elastic.co/t/combining-a-dat-field-and-a-time-field-into-a-single-timestamp/208890)
**Author:** [@Hyperion0](https://discuss.elastic.co/u/Hyperion0)\ **Replies:** 2\ **Last updated:** [November 21, 2019, 1:54pm UTC](https://discuss.elastic.co/t/combining-a-dat-field-and-a-time-field-into-a-single-timestamp/208890 "2019-11-21T13:54:44Z")
I have a text log with date and time listed as 2 separate fields and I want to combine them into a single date-time to use as my timestamp in Kibana. The entry looks like this: 10/03/19 18:04:40 My conf looks somethin… --- ## [Infra details clarification](https://discuss.elastic.co/t/infra-details-clarification/208819)
**Author:** [@raja.arumugam3](https://discuss.elastic.co/u/raja.arumugam3)\ **Replies:** 0\ **Last updated:** [November 21, 2019, 7:11am UTC](https://discuss.elastic.co/t/infra-details-clarification/208819 "2019-11-21T07:11:34Z")
How to decide number of logstash nodes for elastic nodes. Is there is any ratio or calculations are there ? for example, i have 1TB of logs per day, i want to have online retention of 30 days at any point of time. In t… --- ## [Adding fields to next line using Logstash Aggregate](https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684)
**Author:** [@rwcanand](https://discuss.elastic.co/u/rwcanand)\ **Replies:** 2\ **Last updated:** [November 21, 2019, 1:38pm UTC](https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684 "2019-11-21T13:38:57Z")
Hi, I'm trying to implement a use case where I want to add an existing field on a line to the next line. I tried to implement this using aggregate with pipeline.workers set to 1. The sample Log file is as below Data1 … --- ## [Logstash and csv output plugin](https://discuss.elastic.co/t/logstash-and-csv-output-plugin/208891)
**Author:** [@vld53](https://discuss.elastic.co/u/vld53)\ **Replies:** 0\ **Last updated:** [November 21, 2019, 1:22pm UTC](https://discuss.elastic.co/t/logstash-and-csv-output-plugin/208891 "2019-11-21T13:22:00Z")
Hello everybody, I try to export data from elastic by logstash csv output plugin from command line. When I don it logstash get only by 1000 records by step and do it very slowly. How can I increase speed of this proce… --- ## [Is it possible to aggregate nested objects within a nested object?](https://discuss.elastic.co/t/is-it-possible-to-aggregate-nested-objects-within-a-nested-object/208867)
**Author:** [@sjez](https://discuss.elastic.co/u/sjez)\ **Replies:** 0\ **Last updated:** [November 21, 2019, 11:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-aggregate-nested-objects-within-a-nested-object/208867 "2019-11-21T11:20:51Z")
Hi, I am pulling data from an oracle database using jdbc connection and then loading that into ES via logstash. Using the aggregate filter function I am successfully able to nest columns based on a task\_id and using a … --- ## [Logstash automatically loading the config file](https://discuss.elastic.co/t/logstash-automatically-loading-the-config-file/208790)
**Author:** [@Avinaba\_Ghosh\_Hajra](https://discuss.elastic.co/u/Avinaba_Ghosh_Hajra)\ **Replies:** 8\ **Last updated:** [November 21, 2019, 9:06am UTC](https://discuss.elastic.co/t/logstash-automatically-loading-the-config-file/208790 "2019-11-21T09:06:11Z")
Logstash is running via systemctl. It is loading the configuration file automatically after certain interval.So the Configuration file which contains an SQL query is loaded multiple times. JDBC plugin does not contain a… --- ## [How to aggregate database field in nested array as below json format?](https://discuss.elastic.co/t/how-to-aggregate-database-field-in-nested-array-as-below-json-format/208835)
**Author:** [@indra](https://discuss.elastic.co/u/indra)\ **Replies:** 0\ **Last updated:** [November 21, 2019, 8:57am UTC](https://discuss.elastic.co/t/how-to-aggregate-database-field-in-nested-array-as-below-json-format/208835 "2019-11-21T08:57:59Z")
"\_index" : "product", "\_type" : "product", "\_id" : "191201", "\_score" : 1.0, "\_source" : { "styleno" : "191201", "@version" : "1", "@timestamp" : "2019-11-20T15:28:07.322Z", "colors" : "01" \[ { "sizeno" : "024… --- ## [Hour(-5:30 minutes) in all date are getting changed](https://discuss.elastic.co/t/hour-5-30-minutes-in-all-date-are-getting-changed/208827)
**Author:** [@Krishnapriya\_Mahajan](https://discuss.elastic.co/u/Krishnapriya_Mahajan)\ **Replies:** 4\ **Last updated:** [November 21, 2019, 8:31am UTC](https://discuss.elastic.co/t/hour-5-30-minutes-in-all-date-are-getting-changed/208827 "2019-11-21T08:31:00Z")
Hi I am trying to migrate data from mysql to ELastic Search. But in es time is getting changed. in mysql (2017-07-20 16:42:07) to (2017-07-20T11:12:07.000Z) in es . following is my logstash.conf input { jdbc { -- j… --- ## [Logstash 7.1.0 does not start as service RHEL 7](https://discuss.elastic.co/t/logstash-7-1-0-does-not-start-as-service-rhel-7/208279)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 4\ **Last updated:** [November 21, 2019, 8:12am UTC](https://discuss.elastic.co/t/logstash-7-1-0-does-not-start-as-service-rhel-7/208279 "2019-11-21T08:12:48Z")
I just installed logstash 7.1.0 from an RPM with sudo yum install logstash.7.1.0.rpm system has 32 GB RAM. When im trying to run the service as \[root@elk02 ~\]# sudo systemctl start logstash Failed to start logstash.s… --- ## [Help on Ruby required](https://discuss.elastic.co/t/help-on-ruby-required/208808)
**Author:** [@varshesh](https://discuss.elastic.co/u/varshesh)\ **Replies:** 0\ **Last updated:** [November 21, 2019, 5:31am UTC](https://discuss.elastic.co/t/help-on-ruby-required/208808 "2019-11-21T05:31:25Z")
Hello Friends! I have a db field, where the comma seperated ids are stored. I have setup an array of ID =\> VALUE. Example: In DB field cityids , it contains value "2,3,4,5" Array has \[1=\>"Chicago", 2=\>"London",3=\>"D… --- ## [Problem about install logstash-input-plugins on linux](https://discuss.elastic.co/t/problem-about-install-logstash-input-plugins-on-linux/208429)
**Author:** [@karl\_xy](https://discuss.elastic.co/u/karl_xy)\ **Replies:** 1\ **Last updated:** [November 21, 2019, 5:22am UTC](https://discuss.elastic.co/t/problem-about-install-logstash-input-plugins-on-linux/208429 "2019-11-21T05:22:33Z")
i type command: install logstash-input-3.3.0-java.gem then back: install: missing destination file operand after ‘logstash-input-3.3.0-java.gem’ Try 'install --help' for more information. --- ## [How can I see the full name of protocol in the index?(hyphen problem)](https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [November 21, 2019, 2:03am UTC](https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994 "2019-11-21T02:03:32Z")
Hello. I now have an index on elasticsearch after converting the pcap file to json. One of the protocols has a full name of "s7comm-plus", but only "plus" is visible in the index. The other protocols look correctly. … --- ## [Database pulls are getting confused?](https://discuss.elastic.co/t/database-pulls-are-getting-confused/208762)
**Author:** [@mbrown007](https://discuss.elastic.co/u/mbrown007)\ **Replies:** 2\ **Last updated:** [November 20, 2019, 11:04pm UTC](https://discuss.elastic.co/t/database-pulls-are-getting-confused/208762 "2019-11-20T23:04:10Z")
It appears that the second database call is getting data from the first one. 32-db.conf input { jdbc { #jdbc\_driver\_library =\> "/etc/logstash/mysql-connector-java-8.0.18.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Dri… --- ## [Logstash not work(](https://discuss.elastic.co/t/logstash-not-work/208664)
**Author:** [@jleLLlka\_Kozlov](https://discuss.elastic.co/u/jleLLlka_Kozlov)\ **Replies:** 6\ **Last updated:** [November 20, 2019, 7:45pm UTC](https://discuss.elastic.co/t/logstash-not-work/208664 "2019-11-20T19:45:51Z")
\[2019-11-20T09:31:30,990\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.version"=\>"6.8.4"} \[2019-11-20T09:31:37,888\]\[INFO \]\[logstash.pipeline \] Starting pipeline {:pipeline\_id=\>"main", "pipeline.… --- ## [Question about the getting started tutorial](https://discuss.elastic.co/t/question-about-the-getting-started-tutorial/208757)
**Author:** [@Taiv13](https://discuss.elastic.co/u/Taiv13)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 6:47pm UTC](https://discuss.elastic.co/t/question-about-the-getting-started-tutorial/208757 "2019-11-20T18:47:44Z")
I'm currently working my way through the Logstash tutorial, but I've ran into something puzzling. In the "Parsing Logs with Logstash" section, I've gotten to the point where I am reading from Filebeat. I am reading cor… --- ## [Change a string in a field for a number](https://discuss.elastic.co/t/change-a-string-in-a-field-for-a-number/208735)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 2\ **Last updated:** [November 20, 2019, 6:16pm UTC](https://discuss.elastic.co/t/change-a-string-in-a-field-for-a-number/208735 "2019-11-20T18:16:42Z")
Hi, from time to time In the milliseconds field( that is for numbers ) appears the string: "disabled", what Im trying to do, is that every time the string "disabled" appears, change for it the number "0" I have tried wi… --- ## [Log with @timestamp value in it - getting errors](https://discuss.elastic.co/t/log-with-timestamp-value-in-it-getting-errors/208748)
**Author:** [@Chrz](https://discuss.elastic.co/u/Chrz)\ **Replies:** 1\ **Last updated:** [November 20, 2019, 5:54pm UTC](https://discuss.elastic.co/t/log-with-timestamp-value-in-it-getting-errors/208748 "2019-11-20T17:54:13Z")
Hi, Im processing logfile with logstash which unfortunately contains @timestamp value { "@timestamp": "2019-11-20 17:27:02.894", "c": "386", "chl": "B", "event": "Content", "time": "290", "calculationStartDate": "2019-… --- ## [Retry: Pipeline to Pipeline Output Variable Expansion](https://discuss.elastic.co/t/retry-pipeline-to-pipeline-output-variable-expansion/208674)
**Author:** [@Lukas\_L](https://discuss.elastic.co/u/Lukas_L)\ **Replies:** 3\ **Last updated:** [November 20, 2019, 3:30pm UTC](https://discuss.elastic.co/t/retry-pipeline-to-pipeline-output-variable-expansion/208674 "2019-11-20T15:30:24Z")
Hello, I have the same question as described in this post. Since there hasnt been any replies I thought i would just open the same topic again. I am currently using Logstash-7.3.1 with this configuration for all inc… --- ## [Logstash Kafka Input: divided message received](https://discuss.elastic.co/t/logstash-kafka-input-divided-message-received/208705)
**Author:** [@jaypark81](https://discuss.elastic.co/u/jaypark81)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 1:35pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-divided-message-received/208705 "2019-11-20T13:35:07Z")
Hello, I have a question for Logstash Kafka input. Here are versions for what I use: Elasticsearch: 7.3.2 Logstash version: 7.2.1 Kafka version: 2.1.0 Here is input configuration of Logstash: input { kafka { … --- ## [Logstash Syntax :: Force a Newly-Created Field to be an Integer?](https://discuss.elastic.co/t/logstash-syntax-force-a-newly-created-field-to-be-an-integer/208562)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 4\ **Last updated:** [November 20, 2019, 1:32pm UTC](https://discuss.elastic.co/t/logstash-syntax-force-a-newly-created-field-to-be-an-integer/208562 "2019-11-20T13:32:41Z")
Hi Logstash Gurus, I need to build off another syntax question I asked, here. In that post, I learned how to use a Ruby Filter to create a new field, then populate that field with the product of other fields: ruby {… --- ## [Updated data with tracking column for sql server binary timestamp](https://discuss.elastic.co/t/updated-data-with-tracking-column-for-sql-server-binary-timestamp/208700)
**Author:** [@WalterLeff](https://discuss.elastic.co/u/WalterLeff)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 1:20pm UTC](https://discuss.elastic.co/t/updated-data-with-tracking-column-for-sql-server-binary-timestamp/208700 "2019-11-20T13:20:23Z")
Hi all, I have a table with a version column which is a timestamp as a binary. This is changed every time there is a change/update in the row. I can transmit this table to elastic but my format is not really correct \<… --- ## [Logstash unable to query Database](https://discuss.elastic.co/t/logstash-unable-to-query-database/208677)
**Author:** [@bharath.krishn2](https://discuss.elastic.co/u/bharath.krishn2)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 10:36am UTC](https://discuss.elastic.co/t/logstash-unable-to-query-database/208677 "2019-11-20T10:36:28Z")
I'm using jbdc filter in logstash to pull the records. I'm getting the below error in the logstash logs. \[2019-11-20T12:22:01,666\]\[WARN \]\[logstash.inputs.jdbc \] Exception when executing JDBC query {:exception=\>#\ **Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 9:59am UTC](https://discuss.elastic.co/t/logstash-error-could-not-find-or-load-main-class-version/208668 "2019-11-20T09:59:52Z") Hello, Can anyone help me in this? I am trying to run conf file using logstash. i am getting below error: Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was depreca ted in version 9.0 and will li… --- ## [Failed to send event to MongoDB, retrying in 3 seconds {:event=\>#\, :exception=\>#\}](https://discuss.elastic.co/t/failed-to-send-event-to-mongodb-retrying-in-3-seconds-event-logstash-0x2367ca72-exception-argumenterror-wrong-number-of-arguments-2-for-1/208652)
**Author:** [@Paul\_Cheriyan](https://discuss.elastic.co/u/Paul_Cheriyan)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 8:22am UTC](https://discuss.elastic.co/t/failed-to-send-event-to-mongodb-retrying-in-3-seconds-event-logstash-0x2367ca72-exception-argumenterror-wrong-number-of-arguments-2-for-1/208652 "2019-11-20T08:22:54Z")
this my code input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://fgh:3306/fgh?useSSL=false" # The user we wish to execute our statement as jdbc\_user =\> "fghfgh" jdbc\_password =\> "fghfghhfgfgh" # The path to our… --- ## [Enrich one document with fields from another](https://discuss.elastic.co/t/enrich-one-document-with-fields-from-another/208651)
**Author:** [@Reuven\_Weiser](https://discuss.elastic.co/u/Reuven_Weiser)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 8:21am UTC](https://discuss.elastic.co/t/enrich-one-document-with-fields-from-another/208651 "2019-11-20T08:21:55Z")
Imagine I have an ElasticSearch instance with two kinds of data - author and book - both in JSON. Author data looks like this: { "document-id": "XYZ", "document-type": "author", "name": "John Doe", "cou… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=442) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=444)