# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=481 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 482 --- ## [ERROR: Unable to retrieve license information from license server](https://discuss.elastic.co/t/error-unable-to-retrieve-license-information-from-license-server/198514)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [September 7, 2019, 3:27pm UTC](https://discuss.elastic.co/t/error-unable-to-retrieve-license-information-from-license-server/198514 "2019-09-07T15:27:44Z")
Hello World! I'm Running Logstash on Docker | Logstash Reference \[6.8\] | Elastic, yet running into following error: logstash | \[2019-09-07T15:15:06,686\]\[INFO \]\[logstash.configmanagement.bootstrapcheck\] Using Elastic… --- ## [How to exclude bad output (lines not matching 'grok' pattern) from logstash?](https://discuss.elastic.co/t/how-to-exclude-bad-output-lines-not-matching-grok-pattern-from-logstash/40459)
**Author:** [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)\ **Replies:** 8\ **Last updated:** [September 7, 2019, 12:07pm UTC](https://discuss.elastic.co/t/how-to-exclude-bad-output-lines-not-matching-grok-pattern-from-logstash/40459 "2019-09-07T12:07:08Z")
I have a log file and I am parsing it through Logstash and storing it in some place. But the the problem is that some lines in the log file do not always match my grok pattern and are therefore tagged as 'grokparsefailur… --- ## [How to use two grok statements for log files](https://discuss.elastic.co/t/how-to-use-two-grok-statements-for-log-files/198308)
**Author:** [@nizztizz](https://discuss.elastic.co/u/nizztizz)\ **Replies:** 1\ **Last updated:** [September 7, 2019, 10:44am UTC](https://discuss.elastic.co/t/how-to-use-two-grok-statements-for-log-files/198308 "2019-09-07T10:44:55Z")
I want to use two grok statements for my log files. I have two different structures of logs in my folder. How would I do this if I want to match some log files to one of the groks and the rest to the other. These are the… --- ## [Using multiline codec for python stacktrace](https://discuss.elastic.co/t/using-multiline-codec-for-python-stacktrace/198346)
**Author:** [@rajdeep101](https://discuss.elastic.co/u/rajdeep101)\ **Replies:** 10\ **Last updated:** [September 7, 2019, 5:22am UTC](https://discuss.elastic.co/t/using-multiline-codec-for-python-stacktrace/198346 "2019-09-07T05:22:19Z")
Basically i have three types of lines in my log file. Syntax error Error timestamp internal server error url blah blah traceback For the traceback part i am just checking if line begins with a space and appending it i… --- ## [New to ELK - Basic issue with parsing csv file in Logstash](https://discuss.elastic.co/t/new-to-elk-basic-issue-with-parsing-csv-file-in-logstash/198460)
**Author:** [@mdoreswamy](https://discuss.elastic.co/u/mdoreswamy)\ **Replies:** 2\ **Last updated:** [September 6, 2019, 6:31pm UTC](https://discuss.elastic.co/t/new-to-elk-basic-issue-with-parsing-csv-file-in-logstash/198460 "2019-09-06T18:31:14Z")
Need help in decoding the error message thrown by Logstash. // single record in the csv file 1-9,1,8,029030000000201567295889,,,,,,,,,,,,,,,,,,,,,,,,,29,1|1|17742639738,sip:+17742639738@vzims.com,,1|1|19782010063,tel:+… --- ## [Adding syslog ports to filebeats filter](https://discuss.elastic.co/t/adding-syslog-ports-to-filebeats-filter/198438)
**Author:** [@c0mputernick](https://discuss.elastic.co/u/c0mputernick)\ **Replies:** 4\ **Last updated:** [September 6, 2019, 3:38pm UTC](https://discuss.elastic.co/t/adding-syslog-ports-to-filebeats-filter/198438 "2019-09-06T15:38:16Z")
Id like to get logstash accepting syslogs on the default 514 ports both tcp and udp. Im trying to follow this guide for the filters : https://www.elastic.co/guide/en/logstash/6.7/logstash-config-for-filebeat-modules.ht… --- ## [Setup Kibana Netflow Dashboards and Visualizations](https://discuss.elastic.co/t/setup-kibana-netflow-dashboards-and-visualizations/198439)
**Author:** [@arantesgyn](https://discuss.elastic.co/u/arantesgyn)\ **Replies:** 0\ **Last updated:** [September 6, 2019, 2:34pm UTC](https://discuss.elastic.co/t/setup-kibana-netflow-dashboards-and-visualizations/198439 "2019-09-06T14:34:53Z")
Are there some way to setup Kibana Netflow Dashboards and Visualizations from Logstash(Module NETFLOW) application? VERSION: Elasticsearch 7.0.1 Kibana 7.0.1 Logstash 7.3.1 Obs1 : I can´t use CLI opti… --- ## [HTTPD\_COMBINEDLOG not found with docker](https://discuss.elastic.co/t/httpd-combinedlog-not-found-with-docker/63981)
**Author:** [@lendoly](https://discuss.elastic.co/u/lendoly)\ **Replies:** 9\ **Last updated:** [September 6, 2019, 2:31pm UTC](https://discuss.elastic.co/t/httpd-combinedlog-not-found-with-docker/63981 "2019-09-06T14:31:03Z")
Hi all, I'm using the ELK stack with Docker, for Logstash I'm using Logstash:latest (that is Logstash 2.4 at the moment, https://hub.docker.com/\_/logstash/), researching a little in Github and code I see that the patt… --- ## [Logstash kv filter takes each line of log as separate log](https://discuss.elastic.co/t/logstash-kv-filter-takes-each-line-of-log-as-separate-log/198433)
**Author:** [@sonammarda](https://discuss.elastic.co/u/sonammarda)\ **Replies:** 1\ **Last updated:** [September 6, 2019, 2:24pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-takes-each-line-of-log-as-separate-log/198433 "2019-09-06T14:24:46Z")
Logstash version - 7.3 Filebeat version - 7.3 OS - Windows My log format- \log4j… --- ## [Logstash not producing logs](https://discuss.elastic.co/t/logstash-not-producing-logs/198431)
**Author:** [@Rachit\_Gargava](https://discuss.elastic.co/u/Rachit_Gargava)\ **Replies:** 1\ **Last updated:** [September 6, 2019, 2:01pm UTC](https://discuss.elastic.co/t/logstash-not-producing-logs/198431 "2019-09-06T14:01:55Z")
command which I am executing: ./logstash -f Logstash.conf Logstash.conf has below content: input { file { path =\> "/tibco/tra/domain/TST36/application/logs/B2BHFAMAdapter-TST36V3B2BHFAMAdapterNewTST36-050000-1.log" … --- ## [How to convert the array elements to lowercase using logstash](https://discuss.elastic.co/t/how-to-convert-the-array-elements-to-lowercase-using-logstash/198413)
**Author:** [@vishnug](https://discuss.elastic.co/u/vishnug)\ **Replies:** 1\ **Last updated:** [September 6, 2019, 12:30pm UTC](https://discuss.elastic.co/t/how-to-convert-the-array-elements-to-lowercase-using-logstash/198413 "2019-09-06T12:30:50Z")
I have an array field in my elasticsearch document. Array = \["German", "Spanish" , "English"\] I want to convert it to below format Array = \["greman", "spanish", "english" \] How can I convert the array content to lowe… --- ## [Can you ingest geojson in Logstash?](https://discuss.elastic.co/t/can-you-ingest-geojson-in-logstash/198319)
**Author:** [@beezit](https://discuss.elastic.co/u/beezit)\ **Replies:** 3\ **Last updated:** [September 6, 2019, 12:28pm UTC](https://discuss.elastic.co/t/can-you-ingest-geojson-in-logstash/198319 "2019-09-06T12:28:20Z")
Can you ingest geojson thru Logstash for ElasticSearch and Kibana use? --- ## [Jira Error Logging with Logstash / Filebeat](https://discuss.elastic.co/t/jira-error-logging-with-logstash-filebeat/198393)
**Author:** [@dwisnia](https://discuss.elastic.co/u/dwisnia)\ **Replies:** 1\ **Last updated:** [September 6, 2019, 12:25pm UTC](https://discuss.elastic.co/t/jira-error-logging-with-logstash-filebeat/198393 "2019-09-06T12:25:56Z")
Howdy Folks, Disclaimer: I am a bloody beginner at the ELK Stack. We want log the errors and messages from our Atlassian Enviroment. Starting with Jira, we had issues with correct formats in the messages. I already ad… --- ## [Parsing logs from Dockerized NGinx](https://discuss.elastic.co/t/parsing-logs-from-dockerized-nginx/198274)
**Author:** [@JamesRamm](https://discuss.elastic.co/u/JamesRamm)\ **Replies:** 1\ **Last updated:** [September 6, 2019, 11:43am UTC](https://discuss.elastic.co/t/parsing-logs-from-dockerized-nginx/198274 "2019-09-06T11:43:07Z")
Hi I am trying to use the ELK stack to view & index logs from a bunch of services running in docker containers. One such service is NGinX and I would like to start with this. I have deployed filebeat, logstash, elastic… --- ## [Logstash is not exported data to ElasticSearch](https://discuss.elastic.co/t/logstash-is-not-exported-data-to-elasticsearch/198303)
**Author:** [@revglen](https://discuss.elastic.co/u/revglen)\ **Replies:** 4\ **Last updated:** [September 6, 2019, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-not-exported-data-to-elasticsearch/198303 "2019-09-06T08:23:52Z")
Hello All, I am new to ES and experimenting with the product. I have configured Logstash to exported data to ES with the host set to "localhost". "localhost" was set in the ES configuration files also. However, now I ch… --- ## [Logstash conditional not being evaluated](https://discuss.elastic.co/t/logstash-conditional-not-being-evaluated/198288)
**Author:** [@bvoros](https://discuss.elastic.co/u/bvoros)\ **Replies:** 2\ **Last updated:** [September 6, 2019, 8:00am UTC](https://discuss.elastic.co/t/logstash-conditional-not-being-evaluated/198288 "2019-09-06T08:00:36Z")
Hello All, I am trying to make changes to the format of a document and there are conditionals that do not take effect. Original document: { "@timestamp": "2019-09-02T13:10:39.931Z", "tags": \[ "beats\_input\_code… --- ## [Logstash filter organization for own filters](https://discuss.elastic.co/t/logstash-filter-organization-for-own-filters/198362)
**Author:** [@cristianaxion](https://discuss.elastic.co/u/cristianaxion)\ **Replies:** 0\ **Last updated:** [September 6, 2019, 7:49am UTC](https://discuss.elastic.co/t/logstash-filter-organization-for-own-filters/198362 "2019-09-06T07:49:35Z")
Hello good, I have the following filter settings: It is even perfect there because Kibana works perfectly for me, but what I want is to create a filter that collects the following data created with the Grok Debugger i… --- ## [Does logstash require elasticsearch or can it be used as a standalone?](https://discuss.elastic.co/t/does-logstash-require-elasticsearch-or-can-it-be-used-as-a-standalone/198329)
**Author:** [@rwatts3](https://discuss.elastic.co/u/rwatts3)\ **Replies:** 2\ **Last updated:** [September 6, 2019, 1:38am UTC](https://discuss.elastic.co/t/does-logstash-require-elasticsearch-or-can-it-be-used-as-a-standalone/198329 "2019-09-06T01:38:19Z")
Greetings, I would like to know if logstash can be used as a standalone or does it have to point to an elasticsearch instance. I cannot seem to find the answer anywhere on the elastic site. I'd like to simply use logst… --- ## [How to output all data without mapping in http output](https://discuss.elastic.co/t/how-to-output-all-data-without-mapping-in-http-output/198332)
**Author:** [@rwatts3](https://discuss.elastic.co/u/rwatts3)\ **Replies:** 0\ **Last updated:** [September 6, 2019, 1:37am UTC](https://discuss.elastic.co/t/how-to-output-all-data-without-mapping-in-http-output/198332 "2019-09-06T01:37:52Z")
Greetings, I have a logstash pipeline where I am simply wanting to parse logs, run a few filters, then output the entire payload to an external source via the http output plugin. I am using format =\> "message" with a m… --- ## [\_dateparsefailure, can't debug further](https://discuss.elastic.co/t/dateparsefailure-cant-debug-further/198119)
**Author:** [@marinipete](https://discuss.elastic.co/u/marinipete)\ **Replies:** 6\ **Last updated:** [September 5, 2019, 11:04pm UTC](https://discuss.elastic.co/t/dateparsefailure-cant-debug-further/198119 "2019-09-05T23:04:49Z")
So I've been creating logstash pipelines for a while now and this is the first time I came across an issue I couldn't find a solution online or debug further, so I decided to post here. I'm getting '\_dateparsefailure' i… --- ## [Logstash 6.5 doesn't seem to be taking mappings in the config or template](https://discuss.elastic.co/t/logstash-6-5-doesnt-seem-to-be-taking-mappings-in-the-config-or-template/198102)
**Author:** [@jwalls](https://discuss.elastic.co/u/jwalls)\ **Replies:** 3\ **Last updated:** [September 5, 2019, 7:47pm UTC](https://discuss.elastic.co/t/logstash-6-5-doesnt-seem-to-be-taking-mappings-in-the-config-or-template/198102 "2019-09-05T19:47:49Z")
In my config file, I have a bunch of fields and convert them to integer, as shown below input { redis { host =\> "${REDIS\_0\_HOST}" port =\> "${REDIS\_0\_PORT}" data\_type =\> "list" key =\> "logstash" } } i… --- ## [Using conditionals to decide which logs to filter](https://discuss.elastic.co/t/using-conditionals-to-decide-which-logs-to-filter/198305)
**Author:** [@sarahvo](https://discuss.elastic.co/u/sarahvo)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 6:17pm UTC](https://discuss.elastic.co/t/using-conditionals-to-decide-which-logs-to-filter/198305 "2019-09-05T18:17:14Z")
Hi, I'm using the beat utilities to ship logs to Logstash. I only want to parse the logs using the grok filter when it's coming from filebeat, but I can't seem to get it to work. The parsing works the way I want it to, b… --- ## [Query String Syntax for timestamp like this: 12:30:42:069](https://discuss.elastic.co/t/query-string-syntax-for-timestamp-like-this-1242-069/198287)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 5:36pm UTC](https://discuss.elastic.co/t/query-string-syntax-for-timestamp-like-this-1242-069/198287 "2019-09-05T17:36:12Z")
I'm trying to isolate a range based on custom timestamps; example: myTimestamp: 12:30:42:069 Date type: string I'm getting this error: Discover: Expected AND, OR, end of input, whitespace but ":" found. Attempts… --- ## [Logstash with cloudfront](https://discuss.elastic.co/t/logstash-with-cloudfront/197729)
**Author:** [@M\_H](https://discuss.elastic.co/u/M_H)\ **Replies:** 4\ **Last updated:** [September 5, 2019, 4:09pm UTC](https://discuss.elastic.co/t/logstash-with-cloudfront/197729 "2019-09-05T16:09:21Z")
Hi, i am facing issue while i am using following code in my logstash config file. my other logs perfectly land into elasticsearch but somehow this filter didn't enter into elasticsearch. If i used following code separ… --- ## [@timestamp not updated using date filter](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 3:37pm UTC](https://discuss.elastic.co/t/timestamp-not-updated-using-date-filter/198277 "2019-09-05T15:37:07Z")
Hello, I have the following syslog message that I'm injecting using logstash into elasticsearch: \<189\>2019-09-05T16:44:31.766338+02:00 172.x.x.x date=2019-09-05 time=16:44:30 Using logstash I'm first putting the syslo… --- ## [Send log files by filebeat cisco module to logstash](https://discuss.elastic.co/t/send-log-files-by-filebeat-cisco-module-to-logstash/198281)
**Author:** [@bublik96](https://discuss.elastic.co/u/bublik96)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 3:20pm UTC](https://discuss.elastic.co/t/send-log-files-by-filebeat-cisco-module-to-logstash/198281 "2019-09-05T15:20:25Z")
Hello!, I am using ELK to analyze log files for example from Cisco firewall by filebeat cisco module, and I want compare IP's from this logs with file which consist bad IP's. I came to the conclusion to send log files … --- ## [ELK 7.1 - search filter - incomplete search](https://discuss.elastic.co/t/elk-7-1-search-filter-incomplete-search/196533)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 2:32pm UTC](https://discuss.elastic.co/t/elk-7-1-search-filter-incomplete-search/196533 "2019-09-05T14:32:03Z")
Hello, I have problem and I don't understand that. I send logs with filebeat to logstash, it looks like this When I want to search something ex. a word error, I get something like below, rest default fields I c… --- ## [Logstash 6.8.2: Failing to Send to Elasticsearch](https://discuss.elastic.co/t/logstash-6-8-2-failing-to-send-to-elasticsearch/198270)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 2:12pm UTC](https://discuss.elastic.co/t/logstash-6-8-2-failing-to-send-to-elasticsearch/198270 "2019-09-05T14:12:43Z")
Hi, I have three logstashes processing logs and shipping to an elasticsearch 6.8.2 cluster with 18 data nodes via an haproxy loadbalancer. I regularly see the following errors in the logstash logs: \[2019-09-05T13:39:2… --- ## [New to logstash need help with config](https://discuss.elastic.co/t/new-to-logstash-need-help-with-config/197987)
**Author:** [@rajdeep101](https://discuss.elastic.co/u/rajdeep101)\ **Replies:** 11\ **Last updated:** [September 5, 2019, 2:03pm UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-with-config/197987 "2019-09-05T14:03:33Z")
Hi all, I basically want to visualize response time and api url in kibana with users. i have written a simple config file that should only parse the required log line but i am getting error at just before match in \_grok… --- ## [Logstash data ouput to elasticsearch calculation](https://discuss.elastic.co/t/logstash-data-ouput-to-elasticsearch-calculation/195180)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 6\ **Last updated:** [September 5, 2019, 1:52pm UTC](https://discuss.elastic.co/t/logstash-data-ouput-to-elasticsearch-calculation/195180 "2019-09-05T13:52:28Z")
Hello, I am trying to find out how to see how much data is being outputted to elasticsearch from logstash servers. The logstash servers in question are hosted on VMWare at the moment. The logstash server hosted on AWS,… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=480) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=482)