# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=478 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 479 --- ## [Want to replace hostname as identhostname in logstash log output](https://discuss.elastic.co/t/want-to-replace-hostname-as-identhostname-in-logstash-log-output/199148)
**Author:** [@ridhima](https://discuss.elastic.co/u/ridhima)\ **Replies:** 4\ **Last updated:** [September 12, 2019, 4:12pm UTC](https://discuss.elastic.co/t/want-to-replace-hostname-as-identhostname-in-logstash-log-output/199148 "2019-09-12T16:12:15Z")
Currently Our config file 000-grok.conf file has below content: filter { mutate { # squash multiple whitespace gsub =\> \[ "message", "{2,}"," " \] # ditch the dashes gsub =\> \[ "message", "{5}.\*{50,}\\n","" \] # r… --- ## [Filtering Specific Events from Logstash to a SIEM](https://discuss.elastic.co/t/filtering-specific-events-from-logstash-to-a-siem/199312)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 0\ **Last updated:** [September 12, 2019, 6:29pm UTC](https://discuss.elastic.co/t/filtering-specific-events-from-logstash-to-a-siem/199312 "2019-09-12T18:29:33Z")
HI, Right now we have logstash up and running and sending a large volume of logs to elasticsearch which are searchable using kibana. Can a filter be built to send just specific use cases to another location such as Ar… --- ## [Update strategy for SQL server into elastic search](https://discuss.elastic.co/t/update-strategy-for-sql-server-into-elastic-search/199309)
**Author:** [@jonakirke94](https://discuss.elastic.co/u/jonakirke94)\ **Replies:** 0\ **Last updated:** [September 12, 2019, 6:23pm UTC](https://discuss.elastic.co/t/update-strategy-for-sql-server-into-elastic-search/199309 "2019-09-12T18:23:42Z")
Hi everyone. I'm trying to code along this \[guide\]( guide https://www.elastic.co/blog/how-to-keep-elasticsearch-synchronized-with-a-relational-database-using-logstash) but doing it in MSSQL First off there is no UNIX\_T… --- ## [Send file with logstash output plugin](https://discuss.elastic.co/t/send-file-with-logstash-output-plugin/199265)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 0\ **Last updated:** [September 12, 2019, 2:00pm UTC](https://discuss.elastic.co/t/send-file-with-logstash-output-plugin/199265 "2019-09-12T14:00:26Z")
I'm trying to send a .json file from a pc to another with logstash. This is the configuration of sender: input { file { path =\> "/var/log/event.json" sincedb\_path =\> "/var/log/sincedb/.sincedb\_test" start\_… --- ## [Need help regarding the timestamps of logs pushed into ElasticSearch through instance of Logstash](https://discuss.elastic.co/t/need-help-regarding-the-timestamps-of-logs-pushed-into-elasticsearch-through-instance-of-logstash/199021)
**Author:** [@abdulrafay](https://discuss.elastic.co/u/abdulrafay)\ **Replies:** 9\ **Last updated:** [September 12, 2019, 12:15pm UTC](https://discuss.elastic.co/t/need-help-regarding-the-timestamps-of-logs-pushed-into-elasticsearch-through-instance-of-logstash/199021 "2019-09-12T12:15:24Z")
Hello! The issue that I am facing is that I need to manually push some application logs into ES, through Logstash. I am using a separate instance of Logstash to do so, but the place where I am stuck is related to the ti… --- ## [Error parsing json with Logstash](https://discuss.elastic.co/t/error-parsing-json-with-logstash/198749)
**Author:** [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)\ **Replies:** 14\ **Last updated:** [September 12, 2019, 11:32am UTC](https://discuss.elastic.co/t/error-parsing-json-with-logstash/198749 "2019-09-12T11:32:10Z")
Hi there, I'm using ELK 7.3.1 And getting Error parsing json for "message" This is how message looks like in origin (Exacmple)- message {"time\_date": "2019-02-14T14:00:39+00:00","client": "10.xxx.xxx.xxx", "h… --- ## [Http\_poller Web post request](https://discuss.elastic.co/t/http-poller-web-post-request/199232)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 0\ **Last updated:** [September 12, 2019, 10:37am UTC](https://discuss.elastic.co/t/http-poller-web-post-request/199232 "2019-09-12T10:37:07Z")
I'm using http\_poller to use POST request. It is giving error with the body. I added body as below: body =\> '{ "grant\_type":"client\_credentials","scope":"domain" }' Error I'm seeing after running it as Bad request: 40… --- ## [Logstash: Update a string value in message filed using filters](https://discuss.elastic.co/t/logstash-update-a-string-value-in-message-filed-using-filters/199213)
**Author:** [@chimbu3306](https://discuss.elastic.co/u/chimbu3306)\ **Replies:** 0\ **Last updated:** [September 12, 2019, 9:27am UTC](https://discuss.elastic.co/t/logstash-update-a-string-value-in-message-filed-using-filters/199213 "2019-09-12T09:27:41Z")
I have a json message from the lambda logstream where the application is already producing @timestamp value but its not in the expected format. So if i use json filter to parse the message filed its producing the error m… --- ## [Logstah geoIp filter for kibana Map](https://discuss.elastic.co/t/logstah-geoip-filter-for-kibana-map/199226)
**Author:** [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Replies:** 0\ **Last updated:** [September 12, 2019, 10:08am UTC](https://discuss.elastic.co/t/logstah-geoip-filter-for-kibana-map/199226 "2019-09-12T10:08:55Z")
Hi can some one help me on Logstash GeoIP filter ? below is my sample log message 2019-09-10 13:47:45.678 \[INFO\] from application in pool-1-thread-21 - SegmentName : ID Verified Longitude : 39.954752, Latitude : 39.95… --- ## [Logstash load error no such file to load -- bundler](https://discuss.elastic.co/t/logstash-load-error-no-such-file-to-load-bundler/198356)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 1\ **Last updated:** [September 12, 2019, 9:43am UTC](https://discuss.elastic.co/t/logstash-load-error-no-such-file-to-load-bundler/198356 "2019-09-12T09:43:56Z")
Hi, I'm new to the ELK and am having trouble using Logstash to load my data to Elastic. After I type: C:\\Users\\GBS\\Downloads\\logstash\\bin\>logstash -f ../config/filename.conf I get the following error message: \[ERROR… --- ## [Grok filter by file path](https://discuss.elastic.co/t/grok-filter-by-file-path/199097)
**Author:** [@BenP](https://discuss.elastic.co/u/BenP)\ **Replies:** 2\ **Last updated:** [September 12, 2019, 9:43am UTC](https://discuss.elastic.co/t/grok-filter-by-file-path/199097 "2019-09-12T09:43:05Z")
Hello, I'm currently banging my head against the wall trying to make my filters works. My grok patterns are OK but I can't make my conditions to work. The documents are added but there aren't transformed (I can confir… --- ## [Logstash: Fetch the end string using grok or other filters](https://discuss.elastic.co/t/logstash-fetch-the-end-string-using-grok-or-other-filters/198448)
**Author:** [@chimbu3306](https://discuss.elastic.co/u/chimbu3306)\ **Replies:** 2\ **Last updated:** [September 12, 2019, 9:16am UTC](https://discuss.elastic.co/t/logstash-fetch-the-end-string-using-grok-or-other-filters/198448 "2019-09-12T09:16:45Z")
I have a field in my message where I only need the last part of the string but the message length varies for different environments. I tried using grok to fetch the last part of the message but unable to get the expecte… --- ## [Regarding Persistent Queueing](https://discuss.elastic.co/t/regarding-persistent-queueing/198636)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [September 12, 2019, 8:23am UTC](https://discuss.elastic.co/t/regarding-persistent-queueing/198636 "2019-09-12T08:23:59Z")
Hi, Is it possible to identify and tag events which have been persisted to disk and for how long? I'd like to be able to track when events get persisted et al. Regards D --- ## [java.lang.StackOverflowError After Successfully Starting API Endpoint](https://discuss.elastic.co/t/java-lang-stackoverflowerror-after-successfully-starting-api-endpoint/199168)
**Author:** [@indoctrine](https://discuss.elastic.co/u/indoctrine)\ **Replies:** 2\ **Last updated:** [September 12, 2019, 6:04am UTC](https://discuss.elastic.co/t/java-lang-stackoverflowerror-after-successfully-starting-api-endpoint/199168 "2019-09-12T06:04:26Z")
Hello, I am getting a java.lang.StackOverflowError after the Logstash API endpoint successfully starts. I cannot see any errors on the Elasticsearch side. I am running Logstash, Elasticsearch, and Kibana, all on versio… --- ## [How can I access an element in a list by index in Logstash?](https://discuss.elastic.co/t/how-can-i-access-an-element-in-a-list-by-index-in-logstash/199028)
**Author:** [@gitreseteasy](https://discuss.elastic.co/u/gitreseteasy)\ **Replies:** 3\ **Last updated:** [September 12, 2019, 3:15am UTC](https://discuss.elastic.co/t/how-can-i-access-an-element-in-a-list-by-index-in-logstash/199028 "2019-09-12T03:15:27Z")
I want to dynamically route my logs based on the strings in the tags of an event. I can't find any documentation for accessing an index of a list. Is this possible? If so, where can I find documentation on proper syntax? … --- ## [Logstash-http-input having unrecoverable error when logstash is used in systemd](https://discuss.elastic.co/t/logstash-http-input-having-unrecoverable-error-when-logstash-is-used-in-systemd/199161)
**Author:** [@De\_Lin\_Hoo](https://discuss.elastic.co/u/De_Lin_Hoo)\ **Replies:** 3\ **Last updated:** [September 12, 2019, 2:21am UTC](https://discuss.elastic.co/t/logstash-http-input-having-unrecoverable-error-when-logstash-is-used-in-systemd/199161 "2019-09-12T02:21:05Z")
Hi, I am using logstash version 7.3 and I have an unrecoverable error using logstash-http-input plugin. My host operating system is Ubuntu 18 and I installed logstash following the instructions of https://www.elastic.co/… --- ## [Cutting or parsing specific characters out of a filtered variable](https://discuss.elastic.co/t/cutting-or-parsing-specific-characters-out-of-a-filtered-variable/196400)
**Author:** [@Charles\_Badger](https://discuss.elastic.co/u/Charles_Badger)\ **Replies:** 2\ **Last updated:** [September 11, 2019, 8:03pm UTC](https://discuss.elastic.co/t/cutting-or-parsing-specific-characters-out-of-a-filtered-variable/196400 "2019-09-11T20:03:07Z")
I am dealing with a filter where it pulls out sudo commands from RHEL 6 OS. An example is this: "argc=2 a0=sudo a1=chpasswd" I currently in my grok filter use this command to assign it to a variable: ".\*argc=%{DATA:CMD… --- ## [Replace the data of an existing index in Elastic using Logstash](https://discuss.elastic.co/t/replace-the-data-of-an-existing-index-in-elastic-using-logstash/199107)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\ **Replies:** 1\ **Last updated:** [September 11, 2019, 7:50pm UTC](https://discuss.elastic.co/t/replace-the-data-of-an-existing-index-in-elastic-using-logstash/199107 "2019-09-11T19:50:05Z")
is it possible to overwrite the data of an existed index in elasticsearch using logstash when I re-process a json file? --- ## [Logstash and sniffing](https://discuss.elastic.co/t/logstash-and-sniffing/199131)
**Author:** [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Replies:** 0\ **Last updated:** [September 11, 2019, 7:43pm UTC](https://discuss.elastic.co/t/logstash-and-sniffing/199131 "2019-09-11T19:43:45Z")
I have a question and wondering if anyone could help out. Using the sniffing protocol in Logstash do the logstash nodes know where to directly send the payload? Say I have an index on 5 of my 10 nodes and that payload ha… --- ## [Logstash processing messages out of order](https://discuss.elastic.co/t/logstash-processing-messages-out-of-order/196843)
**Author:** [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\ **Replies:** 2\ **Last updated:** [September 11, 2019, 7:28pm UTC](https://discuss.elastic.co/t/logstash-processing-messages-out-of-order/196843 "2019-09-11T19:28:14Z")
I have a long config that looks at several types of messages - very similar to the canonical examples given at the aggregate plugin docs page, Example 1, here's the gist: filter { grok { match =\> { ... } add\_… --- ## [VMware LogInsight grok patterns](https://discuss.elastic.co/t/vmware-loginsight-grok-patterns/199119)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 0\ **Last updated:** [September 11, 2019, 6:36pm UTC](https://discuss.elastic.co/t/vmware-loginsight-grok-patterns/199119 "2019-09-11T18:36:38Z")
Anyone have good samples for grok patterns to parse syslog forwarded LogInsight \[network\] data collected by LogInsight from VMware? Any Hints appreciated, TIA! --- ## [Check if nested field exists not working](https://discuss.elastic.co/t/check-if-nested-field-exists-not-working/199100)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 2\ **Last updated:** [September 11, 2019, 6:32pm UTC](https://discuss.elastic.co/t/check-if-nested-field-exists-not-working/199100 "2019-09-11T18:32:26Z")
I have the following code in my logstash configuration where gsub is not applied if\[exception\]\[stacktrace\] { mutate { gsub =\> \["exception.stacktrace","\\s\*at\\s(?!package).\*", ""\] } } T… --- ## [Logstash-codec-netflow: Unsupported field in template 258 {:type=\>44999, :length=\>32} \[Cisco ASR-1001-X\]](https://discuss.elastic.co/t/logstash-codec-netflow-unsupported-field-in-template-258-type-44999-length-32-cisco-asr-1001-x/198044)
**Author:** [@smaxxx](https://discuss.elastic.co/u/smaxxx)\ **Replies:** 1\ **Last updated:** [September 11, 2019, 3:36pm UTC](https://discuss.elastic.co/t/logstash-codec-netflow-unsupported-field-in-template-258-type-44999-length-32-cisco-asr-1001-x/198044 "2019-09-11T15:36:37Z")
Error message: \[2019-09-02T09:51:06,601\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field in template 258 {:type=\>44999, :length=\>32} \[2019-09-02T09:51:06,602\]\[WARN \]\[logstash.codecs.netflow \] Can't (yet) decode flo… --- ## [How to fetch events using REST api](https://discuss.elastic.co/t/how-to-fetch-events-using-rest-api/196804)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 2\ **Last updated:** [September 11, 2019, 3:29pm UTC](https://discuss.elastic.co/t/how-to-fetch-events-using-rest-api/196804 "2019-09-11T15:29:12Z")
Hello team - We have an use case where we need to get events using REST api. REST api call is protected with authorization token which we generate using a url which is a combination of some parameters. Can we create in… --- ## [How to handle a field in logstash filter whose type is not fixed](https://discuss.elastic.co/t/how-to-handle-a-field-in-logstash-filter-whose-type-is-not-fixed/198942)
**Author:** [@RITZ\_VERMA](https://discuss.elastic.co/u/RITZ_VERMA)\ **Replies:** 6\ **Last updated:** [September 11, 2019, 2:41pm UTC](https://discuss.elastic.co/t/how-to-handle-a-field-in-logstash-filter-whose-type-is-not-fixed/198942 "2019-09-11T14:41:22Z")
i have a 'error' field in whose type is not fixed.normally it is text but when an error occurs it changes to an object.which throws error in logstash.how can i handle that --- ## [Clarification on Index/Index Pattern Creation](https://discuss.elastic.co/t/clarification-on-index-index-pattern-creation/199008)
**Author:** [@Matthew\_Graville](https://discuss.elastic.co/u/Matthew_Graville)\ **Replies:** 0\ **Last updated:** [September 11, 2019, 5:19am UTC](https://discuss.elastic.co/t/clarification-on-index-index-pattern-creation/199008 "2019-09-11T05:19:48Z")
Followed this Elastic link: Parsing your first logs with logstash works great and I can use discover to see the Apache logs in Kibana. Yay! So now, I have my Palo FW logs and have adjusted the Filebeat file from the tu… --- ## [Elasticsearch - Logstash data update issue](https://discuss.elastic.co/t/elasticsearch-logstash-data-update-issue/198176)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 1\ **Last updated:** [September 11, 2019, 12:03pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-data-update-issue/198176 "2019-09-11T12:03:46Z")
Im using the Below JDBC code in Logstash for updating the already existing index in Elasticsearch, without duplicating rows or adding the updated row as another new row. So my issue is, The updated old row does not get… --- ## [Why does logstash not mark \[geoip\]\[location\] as "geo\_point"?](https://discuss.elastic.co/t/why-does-logstash-not-mark-geoip-location-as-geo-point/197309)
**Author:** [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\ **Replies:** 2\ **Last updated:** [September 11, 2019, 12:03pm UTC](https://discuss.elastic.co/t/why-does-logstash-not-mark-geoip-location-as-geo-point/197309 "2019-09-11T12:03:24Z")
Hi. I use logstash to analyze web requests. To build a map of query, I use the geoIP module. When using this module I found a small error :nerd\_face: The documentation says: In practice, the data received does not h… --- ## [Connamara fix\_protocol](https://discuss.elastic.co/t/connamara-fix-protocol/199074)
**Author:** [@kailash](https://discuss.elastic.co/u/kailash)\ **Replies:** 0\ **Last updated:** [September 11, 2019, 11:43am UTC](https://discuss.elastic.co/t/connamara-fix-protocol/199074 "2019-09-11T11:43:21Z")
I have installed fix\_protocol, either the bundled with logstash 7.3 or from https://rubygems.org/gems/logstash-filter-fix\_protocol/ logstash-filter-fix\_protocol-0.3.3.gem. But in both case, logstash failed to find it … --- ## [Extract fields from a json substring](https://discuss.elastic.co/t/extract-fields-from-a-json-substring/199072)
**Author:** [@harshavmb](https://discuss.elastic.co/u/harshavmb)\ **Replies:** 0\ **Last updated:** [September 11, 2019, 11:38am UTC](https://discuss.elastic.co/t/extract-fields-from-a-json-substring/199072 "2019-09-11T11:38:07Z")
I'm fairly new to Logstash filtering stuff. I've below json string { "changed": false, "msg": "Foo Facts: oma\_phase: prd, oma\_app: fsd, oma\_apptype: obe, oma\_componenttype: oltp, oma\_componentname: -, oma\_pea… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=477) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=479)