# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=486 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 487 --- ## [Plugin install -\> jruby.exe: command not found](https://discuss.elastic.co/t/plugin-install-jruby-exe-command-not-found/197085)
**Author:** [@Sindre\_E\_de\_Lange](https://discuss.elastic.co/u/Sindre_E_de_Lange)\ **Replies:** 0\ **Last updated:** [August 28, 2019, 10:21am UTC](https://discuss.elastic.co/t/plugin-install-jruby-exe-command-not-found/197085 "2019-08-28T10:21:50Z")
When I try to install the BigQuery plugin, such that I can stream data from server, via Logstash, to BigQuery: bin/logstash-plugin install logstash-output-google\_bigquery I receive the error message saying /\ **Author:** [@KalleDania](https://discuss.elastic.co/u/KalleDania)\ **Replies:** 1\ **Last updated:** [August 28, 2019, 8:09am UTC](https://discuss.elastic.co/t/rubygems-could-not-find-valid-gem-logstash-output-s3/196780 "2019-08-28T08:09:28Z") Am trying to write a dockerfile that sets up logstash aswell as a logstash output plugin for AWS S3. This: https://rubygems.org/gems/logstash-output-s3 However i keep getting errors, and ive tried other gems too where … --- ## [Split pipeline, multiple pipiline filter in logstash management center](https://discuss.elastic.co/t/split-pipeline-multiple-pipiline-filter-in-logstash-management-center/196297)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 2\ **Last updated:** [August 28, 2019, 3:08am UTC](https://discuss.elastic.co/t/split-pipeline-multiple-pipiline-filter-in-logstash-management-center/196297 "2019-08-28T03:08:21Z")
As we as knew, with logstash pipeline, we can use multiple pipeline for multiple filter logstash on event and logstash will be execute pipeline order by naming of pipline For example : 001-input-beat.conf 002-input-wi… --- ## [Upload logs within a date range](https://discuss.elastic.co/t/upload-logs-within-a-date-range/196871)
**Author:** [@ManuMP](https://discuss.elastic.co/u/ManuMP)\ **Replies:** 3\ **Last updated:** [August 27, 2019, 7:14pm UTC](https://discuss.elastic.co/t/upload-logs-within-a-date-range/196871 "2019-08-27T19:14:21Z")
We are using the following filter condition for uploading log entries. The filter will upload all log entries in the files. We would like to restrict the upload of log entries within a date range and not all log entries.… --- ## [Issue while Parsing XML data](https://discuss.elastic.co/t/issue-while-parsing-xml-data/196988)
**Author:** [@satyam2593](https://discuss.elastic.co/u/satyam2593)\ **Replies:** 3\ **Last updated:** [August 27, 2019, 7:03pm UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data/196988 "2019-08-27T19:03:12Z")
I have log data which is mixed with xml content in single line.. When i used xml filter to parse the data , i am not seeing any events added. My input log: INFO | jvm 1 | 2019/08/27 12:47:51.895 |\ Logstash =\> Elasticsearch ingestion](https://discuss.elastic.co/t/beats-logstash-elasticsearch-ingestion/195986)
**Author:** [@payneb25827](https://discuss.elastic.co/u/payneb25827)\ **Replies:** 13\ **Last updated:** [August 27, 2019, 6:52pm UTC](https://discuss.elastic.co/t/beats-logstash-elasticsearch-ingestion/195986 "2019-08-27T18:52:49Z")
Hello, I am new user of the elastic components. I am trying to get a FileBeats =\> Logstash =\> ElasticSearch pipeline working. I have been able to verify LS =\> ES working, but nothing is happening with FB =\> LS. I have ch… --- ## [How to search log line for a specific pattern format](https://discuss.elastic.co/t/how-to-search-log-line-for-a-specific-pattern-format/196977)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 1\ **Last updated:** [August 27, 2019, 5:04pm UTC](https://discuss.elastic.co/t/how-to-search-log-line-for-a-specific-pattern-format/196977 "2019-08-27T17:04:39Z")
Is it possible to search for a generic pattern within a log line? Our log lines are a bit disorganized. They come in many different flavors and formats from different systems, but they all contain a date and time stamp.… --- ## [Exception: Faraday::SSLError Elasticsearch input](https://discuss.elastic.co/t/exception-faraday-sslerror-elasticsearch-input/196558)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [August 27, 2019, 4:20pm UTC](https://discuss.elastic.co/t/exception-faraday-sslerror-elasticsearch-input/196558 "2019-08-27T16:20:41Z")
I'm trying to use the Elasticsearch input, but I'm getting an error when I start the plugin. Below is my config and the error. I'm using the internal elastic super user account and the same certificate bundle that is u… --- ## [Logstash 7.3.0 - Failed to load mssql-jdbc-7.4.1.jre11.jar](https://discuss.elastic.co/t/logstash-7-3-0-failed-to-load-mssql-jdbc-7-4-1-jre11-jar/196319)
**Author:** [@saravanan\_palanivel](https://discuss.elastic.co/u/saravanan_palanivel)\ **Replies:** 5\ **Last updated:** [August 27, 2019, 3:55pm UTC](https://discuss.elastic.co/t/logstash-7-3-0-failed-to-load-mssql-jdbc-7-4-1-jre11-jar/196319 "2019-08-27T15:55:15Z")
Hi Team, ELK : 7.3.0 on Kubernetes MSSQL JDBC Driver : mssql-jdbc-7.4.1.jre11.jar OpenJDK Version: openjdk 11.0.4 2019-07-16 LTS I'm trying to deploy Logstash 7.3.0 pod into my on-premise Kubernetes cluster with a pi… --- ## [Assign a value if field has no value present](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [August 27, 2019, 3:47pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578 "2019-08-27T15:47:17Z")
I am gone a read a csv formated file which has more then 50 field, by default I want to assign a value "UNKNOWN" to any blank field. how do I easily do it ? on smaller files I have done if !\[var1\] { mutate {update....… --- ## [Siebel Workflow Monitor Log](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 3\ **Last updated:** [August 27, 2019, 3:17pm UTC](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840 "2019-08-27T15:17:18Z")
Hi, I have string extracted by "multiline" and it looks like below: "massage": "ts\_action: 2019-08-23 01:22:14, Action ID: 1-13RK8A8Z, ts\_action: 2019-08-23 01:22:14, Action ID: 1 + 1CU2 + 93, ts\_action : 2019 -08-23 01… --- ## [Using grok to extract android log data](https://discuss.elastic.co/t/using-grok-to-extract-android-log-data/196904)
**Author:** [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\ **Replies:** 1\ **Last updated:** [August 27, 2019, 12:51pm UTC](https://discuss.elastic.co/t/using-grok-to-extract-android-log-data/196904 "2019-08-27T12:51:23Z")
Hi all, I'm a new user in ELK and logstash, and I'm trying to extract the following log with grok but without success for now. This is my log: 08-14 10:22:50.863 1419 1419 D GpsNetInitiatedHandler: location enabled :… --- ## [Analyze string arrays created by kv with grok](https://discuss.elastic.co/t/analyze-string-arrays-created-by-kv-with-grok/196954)
**Author:** [@mattia\_conversano](https://discuss.elastic.co/u/mattia_conversano)\ **Replies:** 1\ **Last updated:** [August 27, 2019, 1:52pm UTC](https://discuss.elastic.co/t/analyze-string-arrays-created-by-kv-with-grok/196954 "2019-08-27T13:52:04Z")
Hi guys, I have a problem with grok, let me explain better; Initially I have an array of strings like this: ..,"Warning. detected XSS using libinjection. \[file \\"/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATIO… --- ## [Trigger output Exec once if file exists](https://discuss.elastic.co/t/trigger-output-exec-once-if-file-exists/196830)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\ **Replies:** 8\ **Last updated:** [August 27, 2019, 1:38pm UTC](https://discuss.elastic.co/t/trigger-output-exec-once-if-file-exists/196830 "2019-08-27T13:38:44Z")
I have this logstash conf. file: input { file { path =\> "/usr/share/src-input/x\_tran.csv" start\_position =\> beginning sincedb\_path =\> "/dev/null" mode =\> read } } output { exec { comma… --- ## [Unable to visualize the dashboards after importing](https://discuss.elastic.co/t/unable-to-visualize-the-dashboards-after-importing/196943)
**Author:** [@dharani](https://discuss.elastic.co/u/dharani)\ **Replies:** 0\ **Last updated:** [August 27, 2019, 11:49am UTC](https://discuss.elastic.co/t/unable-to-visualize-the-dashboards-after-importing/196943 "2019-08-27T11:49:27Z")
Hello Team, Recently i took a kibana backup by exporting the dashboards all to on single (json) file and then i imported json to the (same version kibana 6.6 to different system)now the dashboards which i created wer… --- ## [Ilm with Logstash - moving from hot-warm-cold-delete](https://discuss.elastic.co/t/ilm-with-logstash-moving-from-hot-warm-cold-delete/196070)
**Author:** [@pastechecker](https://discuss.elastic.co/u/pastechecker)\ **Replies:** 1\ **Last updated:** [August 27, 2019, 10:59am UTC](https://discuss.elastic.co/t/ilm-with-logstash-moving-from-hot-warm-cold-delete/196070 "2019-08-27T10:59:45Z")
Hello. I am a little bit confused about the order of operation in regards to the ILM and Logstash. I am preparing the configuration before attempting to do the ingestion. I will have a lot of data and want to plan in ad… --- ## [Codec multiline](https://discuss.elastic.co/t/codec-multiline/195204)
**Author:** [@uma\_rengasamy](https://discuss.elastic.co/u/uma_rengasamy)\ **Replies:** 3\ **Last updated:** [August 27, 2019, 10:02am UTC](https://discuss.elastic.co/t/codec-multiline/195204 "2019-08-27T10:02:57Z")
Can we add below codec =\> multiline in filter section ? if \[sourcetype =~ /error/\] { codec =\> multiline { pattern =\> "(^%{TOMCAT\_DATESTAMP})|(^%{CATALINA\_DATESTAMP})" negate =\> true what =\> "previous" } } --- ## [Logstash not receiving Docker syslog input](https://discuss.elastic.co/t/logstash-not-receiving-docker-syslog-input/196770)
**Author:** [@jjarzyns](https://discuss.elastic.co/u/jjarzyns)\ **Replies:** 2\ **Last updated:** [August 27, 2019, 8:35am UTC](https://discuss.elastic.co/t/logstash-not-receiving-docker-syslog-input/196770 "2019-08-27T08:35:06Z")
I am facing an issue with the ELK stack and docker syslog. I used tcpdump and confirmed that log entries are being sent to the port exposed by my Logstash container but for some reason they don't show up in the container… --- ## [Please update your Logstash mutate split documentation example](https://discuss.elastic.co/t/please-update-your-logstash-mutate-split-documentation-example/196893)
**Author:** [@MrFrost](https://discuss.elastic.co/u/MrFrost)\ **Replies:** 0\ **Last updated:** [August 27, 2019, 7:27am UTC](https://discuss.elastic.co/t/please-update-your-logstash-mutate-split-documentation-example/196893 "2019-08-27T07:27:37Z")
I was browsing mutate -\> split documentation and example is messed up, took me a while to find the solution what was wrong. Deprecated doc link: https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.h… --- ## [Logstash 7.1.0 crashes occasionally (xml plugin) but v. 6.3.1 works fine](https://discuss.elastic.co/t/logstash-7-1-0-crashes-occasionally-xml-plugin-but-v-6-3-1-works-fine/195476)
**Author:** [@Ged](https://discuss.elastic.co/u/Ged)\ **Replies:** 5\ **Last updated:** [August 27, 2019, 7:26am UTC](https://discuss.elastic.co/t/logstash-7-1-0-crashes-occasionally-xml-plugin-but-v-6-3-1-works-fine/195476 "2019-08-27T07:26:03Z")
HI guys, I've two instances of ELK stack grepping the same log files containing XML payloads. Flow is : input-plugin-file -\> filter-plugin-grok -\> filter-plugin-xml. Log lines from files are parsed using grok and one … --- ## [How to capture remote client machines' system and application status through Logstash running on server?](https://discuss.elastic.co/t/how-to-capture-remote-client-machines-system-and-application-status-through-logstash-running-on-server/196617)
**Author:** [@timelion01](https://discuss.elastic.co/u/timelion01)\ **Replies:** 1\ **Last updated:** [August 27, 2019, 7:24am UTC](https://discuss.elastic.co/t/how-to-capture-remote-client-machines-system-and-application-status-through-logstash-running-on-server/196617 "2019-08-27T07:24:08Z")
Hi, I need some help for using Logstash to capture monitoring stats. We have a client server application setup where the ELK (Elasticsearch, Logstash and Kibana) are hosted on the server and the client machines (which … --- ## [Logstash update an existing row without a duplicate](https://discuss.elastic.co/t/logstash-update-an-existing-row-without-a-duplicate/196882)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 0\ **Last updated:** [August 27, 2019, 6:33am UTC](https://discuss.elastic.co/t/logstash-update-an-existing-row-without-a-duplicate/196882 "2019-08-27T06:33:13Z")
Im using the Below JDBC code in Logstash for updating the already existing index in Elasticsearch, without duplicating rows or adding the updated row as another new row. So my issue is, The updated old row does not get… --- ## [Merge and transform more than one csv or json files to elasticsearch from logstash or ingest node pipeline (beginner)](https://discuss.elastic.co/t/merge-and-transform-more-than-one-csv-or-json-files-to-elasticsearch-from-logstash-or-ingest-node-pipeline-beginner/196503)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 4\ **Last updated:** [August 27, 2019, 5:24am UTC](https://discuss.elastic.co/t/merge-and-transform-more-than-one-csv-or-json-files-to-elasticsearch-from-logstash-or-ingest-node-pipeline-beginner/196503 "2019-08-27T05:24:38Z")
I wanted to know how to merge and transform more than one csv or json files to elasticsearch from logstash or ingest node pipeline. \*hotel.csv hotelcode hotelname starcode \*star.csv starcode starrating after merg… --- ## [\_node/stats/pipelines API only returns one pipeline stats](https://discuss.elastic.co/t/node-stats-pipelines-api-only-returns-one-pipeline-stats/195283)
**Author:** [@BSsc](https://discuss.elastic.co/u/BSsc)\ **Replies:** 3\ **Last updated:** [August 27, 2019, 4:40am UTC](https://discuss.elastic.co/t/node-stats-pipelines-api-only-returns-one-pipeline-stats/195283 "2019-08-27T04:40:29Z")
Hi, We've been using this API to monitor the persistent queue health of our multiple pipelines.. we ran through a couple of upgrades from 6.X to 7.3.0, and now this API call only returns stats on one pipeline.. when pre… --- ## [How to transfer different structure csv files to existing index in elasticseach](https://discuss.elastic.co/t/how-to-transfer-different-structure-csv-files-to-existing-index-in-elasticseach/196758)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 0\ **Last updated:** [August 26, 2019, 11:52am UTC](https://discuss.elastic.co/t/how-to-transfer-different-structure-csv-files-to-existing-index-in-elasticseach/196758 "2019-08-26T11:52:00Z")
hotel1 and star csv files merge and transfer to elasticsearch. hotel2.csv just transfer to elasticseach. both data should append to existing index in hotel in elasticsearch \*hotel1.csv hcode hname starcode \*star.csv … --- ## [Custom pattern not working](https://discuss.elastic.co/t/custom-pattern-not-working/196722)
**Author:** [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\ **Replies:** 2\ **Last updated:** [August 26, 2019, 11:05pm UTC](https://discuss.elastic.co/t/custom-pattern-not-working/196722 "2019-08-26T23:05:53Z")
hi guys, I want to parse the value like 'ABC\_100', and I am trying to use the custom pattern as this: ALPHANUM %{WORD}\_%{NUMBER} When I use the GROK pattern in the filter as %{ALPHANUM:alphanumber}, it is not parsed, bu… --- ## [Logstash 6.3 Multiple pipelines for one output to different output](https://discuss.elastic.co/t/logstash-6-3-multiple-pipelines-for-one-output-to-different-output/196838)
**Author:** [@chitraj8](https://discuss.elastic.co/u/chitraj8)\ **Replies:** 0\ **Last updated:** [August 26, 2019, 8:14pm UTC](https://discuss.elastic.co/t/logstash-6-3-multiple-pipelines-for-one-output-to-different-output/196838 "2019-08-26T20:14:20Z")
Hi I have 10 kafka topic messages to be read for 3 different services which are configured as inputs in logstash. We do enrich data by grok filters and mutate with date fields. Ouput of these messages are sent to 3 de… --- ## [Logstash error to configure java 11 - sql server](https://discuss.elastic.co/t/logstash-error-to-configure-java-11-sql-server/196831)
**Author:** [@crisao](https://discuss.elastic.co/u/crisao)\ **Replies:** 0\ **Last updated:** [August 26, 2019, 7:47pm UTC](https://discuss.elastic.co/t/logstash-error-to-configure-java-11-sql-server/196831 "2019-08-26T19:47:21Z")
Error logstash to configure java 11 to make sql server data etl {"logstash.version"=\>"7.3.1"} input { jdbc { jdbc\_driver\_library =\> "/etc/logstash/sql/sqljdbc\_7.4/enu/mssql-jdbc-7.4.1.jre11.jar" jdbc\_driver\_class =\>… --- ## [SEND JSON LOGSTASH](https://discuss.elastic.co/t/send-json-logstash/196826)
**Author:** [@Camilo\_Franco](https://discuss.elastic.co/u/Camilo_Franco)\ **Replies:** 1\ **Last updated:** [August 26, 2019, 7:17pm UTC](https://discuss.elastic.co/t/send-json-logstash/196826 "2019-08-26T19:17:40Z")
Hello I'm trying to send a json like this { "Modified": "2019-08-22T10:15:11.617000", "Published": "2019-08-22T10:15:11.617000", "capec": \[ { "id": "17", "name": "Accessing, Modifying or Executing… --- ## [Logstash out put based on log.file.path](https://discuss.elastic.co/t/logstash-out-put-based-on-log-file-path/196766)
**Author:** [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Replies:** 7\ **Last updated:** [August 26, 2019, 6:12pm UTC](https://discuss.elastic.co/t/logstash-out-put-based-on-log-file-path/196766 "2019-08-26T18:12:52Z")
Hello everyone, i have a very basic logstash configuration file.getting multiple log from filebeat. what i want to do is having different index based on file path.this is what i have done so far for output section: ou… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=485) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=487)