# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=492 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 493 --- ## [Logstash Filtering client hostname](https://discuss.elastic.co/t/logstash-filtering-client-hostname/195507)
**Author:** [@candre.dabney](https://discuss.elastic.co/u/candre.dabney)\ **Replies:** 0\ **Last updated:** [August 16, 2019, 1:58pm UTC](https://discuss.elastic.co/t/logstash-filtering-client-hostname/195507 "2019-08-16T13:58:54Z")
We have our environment, which is operating off of Centos 7, set up so that client machines forward their syslog data to our elk server. We'd like to know how we can edit the /etc/logstash/conf.d/10-syslog-filter.conf t… --- ## [Optimize grok filter](https://discuss.elastic.co/t/optimize-grok-filter/194906)
**Author:** [@JeanM](https://discuss.elastic.co/u/JeanM)\ **Replies:** 7\ **Last updated:** [August 16, 2019, 12:49pm UTC](https://discuss.elastic.co/t/optimize-grok-filter/194906 "2019-08-16T12:49:48Z")
Hello, I search some help in order to optimize grok filter. Actually, i have 100% CPU used. Have you some tricks ? Sincerely --- ## [Logstash is creating temp file and dlls every minute in windows environment](https://discuss.elastic.co/t/logstash-is-creating-temp-file-and-dlls-every-minute-in-windows-environment/195491)
**Author:** [@sivarao](https://discuss.elastic.co/u/sivarao)\ **Replies:** 0\ **Last updated:** [August 16, 2019, 12:39pm UTC](https://discuss.elastic.co/t/logstash-is-creating-temp-file-and-dlls-every-minute-in-windows-environment/195491 "2019-08-16T12:39:42Z")
Hello, need help to resolve the issue i am having with Logstash. i am running the logstash as a windows service and every minute it is creating "jruby-2060" folders and "jffi864646030055918690.dll" files in c:\\windows\\te… --- ## [Hello! I want to use multiline codec patterns in my use case.. Here I want to read the multiple lines as one event](https://discuss.elastic.co/t/hello-i-want-to-use-multiline-codec-patterns-in-my-use-case-here-i-want-to-read-the-multiple-lines-as-one-event/195473)
**Author:** [@satyam2593](https://discuss.elastic.co/u/satyam2593)\ **Replies:** 1\ **Last updated:** [August 16, 2019, 11:26am UTC](https://discuss.elastic.co/t/hello-i-want-to-use-multiline-codec-patterns-in-my-use-case-here-i-want-to-read-the-multiple-lines-as-one-event/195473 "2019-08-16T11:26:47Z")
My input logs looks like: START the log printing 08/09/2019 10:12:45 43003|Thread1|20.3|33.4 34532|Thread2|73.5|75.5 END the log printing 08/09/2019 10:13:05 Can anyone please provide the input filter with multiline c… --- ## [Not procesing logstash data to elasticsearch with error: \[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]](https://discuss.elastic.co/t/not-procesing-logstash-data-to-elasticsearch-with-error-org-logstash-instrument-metrics-gauge-lazydelegatinggauge/194597)
**Author:** [@HikariNTB](https://discuss.elastic.co/u/HikariNTB)\ **Replies:** 10\ **Last updated:** [August 16, 2019, 8:38am UTC](https://discuss.elastic.co/t/not-procesing-logstash-data-to-elasticsearch-with-error-org-logstash-instrument-metrics-gauge-lazydelegatinggauge/194597 "2019-08-16T08:38:08Z")
Hi, I had installed ELK on a CentOS7 machine and then make my ELK work with more than 10GB data. After 2 weeks I stopped Logstash and clean all data and indices at Kibana. It took 3 more weeks until I didn't start it ag… --- ## [Logstash indexing](https://discuss.elastic.co/t/logstash-indexing/195443)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 2\ **Last updated:** [August 16, 2019, 7:19am UTC](https://discuss.elastic.co/t/logstash-indexing/195443 "2019-08-16T07:19:54Z")
I have parse data through logstash index has been made in kibana ... but then i try to modify the config file and try to run logstash it hangs . I change the config file name and change the index name but it still hangs … --- ## [Logstash stopped processing because of an error: (SystemExit)](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit/195430)
**Author:** [@pharshil9697](https://discuss.elastic.co/u/pharshil9697)\ **Replies:** 0\ **Last updated:** [August 16, 2019, 5:40am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit/195430 "2019-08-16T05:40:51Z")
I just installed and run Logstash 7.2.1, it displayed this error log. \[2019-08-16T11:03:02,006\]\[INFO \]\[logstash.setting.writabledirectory\] Creating directory {:setting=\>"path.queue", :path=\>"D:/logstash-7.2.1/logstash-7… --- ## [Grok for logstash](https://discuss.elastic.co/t/grok-for-logstash/194858)
**Author:** [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\ **Replies:** 2\ **Last updated:** [August 16, 2019, 2:54am UTC](https://discuss.elastic.co/t/grok-for-logstash/194858 "2019-08-16T02:54:51Z")
Hi All, i have a log which contains the message as below message ProName = 'Core:Worthiness:Price' as of now i'm using the %{CISCO\_REASON}= %{QS:proname} grok to extact it, but getting the whole Core:Worthiness:Price … --- ## [Multiline input codec not working (php stacktrace)](https://discuss.elastic.co/t/multiline-input-codec-not-working-php-stacktrace/195414)
**Author:** [@paul\_m](https://discuss.elastic.co/u/paul_m)\ **Replies:** 0\ **Last updated:** [August 16, 2019, 2:03am UTC](https://discuss.elastic.co/t/multiline-input-codec-not-working-php-stacktrace/195414 "2019-08-16T02:03:31Z")
Hi folks, I'm running logstash 6.4 with a gelf login using the multiline codec, and I can't get it to recognise the pattern. Ideally the pattern I want to attach to the previous line is ^(#|StackStrace), but I'm failing… --- ## [\_geoip\_lookup\_failure though all geoip fields are populated](https://discuss.elastic.co/t/geoip-lookup-failure-though-all-geoip-fields-are-populated/195267)
**Author:** [@nnet](https://discuss.elastic.co/u/nnet)\ **Replies:** 16\ **Last updated:** [August 15, 2019, 1:23pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-though-all-geoip-fields-are-populated/195267 "2019-08-15T13:23:05Z")
Hi folks, using ELK 5.6.16. I'm attempting to geoip iptables logs. I'm seeing geoip fields being populated, but tags field shows \_geoip\_lookup\_failure as well as the tags I apply in my grok. Input is provided by filebe… --- ## [Newb rsyslogd vs logstash question](https://discuss.elastic.co/t/newb-rsyslogd-vs-logstash-question/195398)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 9:41pm UTC](https://discuss.elastic.co/t/newb-rsyslogd-vs-logstash-question/195398 "2019-08-15T21:41:23Z")
Please clear the topic of whether to use rsyslog or logstash itself as the syslog receiver. This thread (https://github.com/elastic/logstash/issues/2965) implies that using ryslog has a great benefit over logstash as a … --- ## [Splitting multiple arrays of objects from a single log](https://discuss.elastic.co/t/splitting-multiple-arrays-of-objects-from-a-single-log/195375)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 6\ **Last updated:** [August 15, 2019, 9:32pm UTC](https://discuss.elastic.co/t/splitting-multiple-arrays-of-objects-from-a-single-log/195375 "2019-08-15T21:32:54Z")
If I need to split multiple arrays of objects from a single log, let's say, I have 3 arrays in a log, let's say something like this: "arrays1" : \[{o1}, {o2}, {o3}, {o4}, {o5}, {o6}\] "arrays2" : \[{ob1}, {ob2}, {ob3}, … --- ## [XML ingestion splits object and reads one object as two separate objects creating errors](https://discuss.elastic.co/t/xml-ingestion-splits-object-and-reads-one-object-as-two-separate-objects-creating-errors/195382)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 6:53pm UTC](https://discuss.elastic.co/t/xml-ingestion-splits-object-and-reads-one-object-as-two-separate-objects-creating-errors/195382 "2019-08-15T18:53:33Z")
Trying to ingest an xml with a format like; \ \\ \\ \ \\ \\ \\ \\ \\ \\ ......(same as above\>) \ **Author:** [@datawrangler](https://discuss.elastic.co/u/datawrangler)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 6:21pm UTC](https://discuss.elastic.co/t/null-error-with-greater-than-comparison-on-an-integer-field/194313 "2019-08-15T18:21:06Z") Hello All, I am getting an error which suggests that my if-statement is trying to do a \> (greater-than) expression comparison against a null value. When I comment out the if-statement everything works as expected. Here… --- ## [Logstash date filter for @timestamp and conversion](https://discuss.elastic.co/t/logstash-date-filter-for-timestamp-and-conversion/195368)
**Author:** [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 5:33pm UTC](https://discuss.elastic.co/t/logstash-date-filter-for-timestamp-and-conversion/195368 "2019-08-15T17:33:15Z")
I currently have a field called time which has a the time my file was created in this format: dd-MM-yyyy\_HHmmss. I would like to change the @timestamp to be the the time of file creation(time from my time field) instead … --- ## [Specify a grok pattern to specific files?](https://discuss.elastic.co/t/specify-a-grok-pattern-to-specific-files/195360)
**Author:** [@cjb312](https://discuss.elastic.co/u/cjb312)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 3:06pm UTC](https://discuss.elastic.co/t/specify-a-grok-pattern-to-specific-files/195360 "2019-08-15T15:06:32Z")
Is there a way to specify a pattern to a specific file? For example I have a filter working for all byte\_count files. I want to add more filters for other files. How would I do this to match the file and pattern combin… --- ## [Starting Filebeat with Logstash breaks Metricbeat](https://discuss.elastic.co/t/starting-filebeat-with-logstash-breaks-metricbeat/195364)
**Author:** [@carson](https://discuss.elastic.co/u/carson)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 2:49pm UTC](https://discuss.elastic.co/t/starting-filebeat-with-logstash-breaks-metricbeat/195364 "2019-08-15T14:49:57Z")
I'm using a standard configuration for logstash to input from beats and output to elasticsearch. I'm also using a standard Filebeat configuration. Metricbeat works fine, but once I start an instance of Filebeat, the met… --- ## [How to retrieve a string that starts with another string using grok?](https://discuss.elastic.co/t/how-to-retrieve-a-string-that-starts-with-another-string-using-grok/195053)
**Author:** [@Siri\_sour](https://discuss.elastic.co/u/Siri_sour)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 2:00pm UTC](https://discuss.elastic.co/t/how-to-retrieve-a-string-that-starts-with-another-string-using-grok/195053 "2019-08-15T14:00:38Z")
Hi everyone, I just starting working with es and kibana, right now I'm trying to structure this log : 2019-08-13 03:37:49,738 \[default task-28\] ERROR \[org.jboss.jca.core.connectionmanager.listener.TxConnectionListener\]… --- ## [Nested Json parse failure in logstash?](https://discuss.elastic.co/t/nested-json-parse-failure-in-logstash/195054)
**Author:** [@Abdul\_Gaffar\_Shaikh](https://discuss.elastic.co/u/Abdul_Gaffar_Shaikh)\ **Replies:** 8\ **Last updated:** [August 15, 2019, 7:11am UTC](https://discuss.elastic.co/t/nested-json-parse-failure-in-logstash/195054 "2019-08-15T07:11:00Z")
hi Guys, I am trying to parse my json into logstash and finally into ES, but giving all try i am failing . Could you please help with it input { file{ path =\> "${JSON\_HOME}/\*.json" #path =\> "C:/Users/ashaik13/Dev/sof… --- ## [How can i parse the below data and add time stamp for the thread level events](https://discuss.elastic.co/t/how-can-i-parse-the-below-data-and-add-time-stamp-for-the-thread-level-events/195327)
**Author:** [@satyam2593](https://discuss.elastic.co/u/satyam2593)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 10:33am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-below-data-and-add-time-stamp-for-the-thread-level-events/195327 "2019-08-15T10:33:15Z")
I want to parse the logs and add the datetime field value to the thread names. Below is my input logs: START the log printing 08/08/19 09:10:06 343 PID|THREAD NAME|CPU UTILIZATION|MEMORY UTILIZATION 7066|DestroyJav… --- ## [Logstash filter for parsing nested json](https://discuss.elastic.co/t/logstash-filter-for-parsing-nested-json/195299)
**Author:** [@binoy\_cg](https://discuss.elastic.co/u/binoy_cg)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 5:59am UTC](https://discuss.elastic.co/t/logstash-filter-for-parsing-nested-json/195299 "2019-08-15T05:59:34Z")
I am trying to ingest a nested json file from couchdb using couchdb\_changes plugin ,since the number of fields are very huge I tried with increasing the maximum number of field parameter for the index but finally Elasti… --- ## [Logstash and doc versioning](https://discuss.elastic.co/t/logstash-and-doc-versioning/195294)
**Author:** [@Vabida](https://discuss.elastic.co/u/Vabida)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 4:16am UTC](https://discuss.elastic.co/t/logstash-and-doc-versioning/195294 "2019-08-15T04:16:40Z")
Hello. I need help i can't understand why my doc versions staying in elastic unupgraded (version 1 and that's all). I have ELK on one node which accepts network logs by logstash and keeps them. In logstash filters i hav… --- ## [Multiline match wrong](https://discuss.elastic.co/t/multiline-match-wrong/195292)
**Author:** [@cevin](https://discuss.elastic.co/u/cevin)\ **Replies:** 0\ **Last updated:** [August 15, 2019, 3:45am UTC](https://discuss.elastic.co/t/multiline-match-wrong/195292 "2019-08-15T03:45:09Z")
log file --------------------------------------------------------------- \[ 2019-08-14T09:16:11+08:00 \] 127.0.0.1 GET localhost:8000/ \[ error \] xxx \[ error \] xxxxx \[ error \] xxxxx ---------------------------------------… --- ## [A few questions about grok](https://discuss.elastic.co/t/a-few-questions-about-grok/195237)
**Author:** [@thedraketaylor](https://discuss.elastic.co/u/thedraketaylor)\ **Replies:** 4\ **Last updated:** [August 15, 2019, 12:26am UTC](https://discuss.elastic.co/t/a-few-questions-about-grok/195237 "2019-08-15T00:26:30Z")
EDIT It looks like my formatting got blown out so all my config changes are now in pastebin in a hopefully easier to read format at https://pastebin.com/DJ0FawPp End Edit I'm trying to use logstash to parse scrapy log… --- ## [How to design output section to receive all logs based on timestamp](https://discuss.elastic.co/t/how-to-design-output-section-to-receive-all-logs-based-on-timestamp/195241)
**Author:** [@Bob94](https://discuss.elastic.co/u/Bob94)\ **Replies:** 2\ **Last updated:** [August 15, 2019, 12:17am UTC](https://discuss.elastic.co/t/how-to-design-output-section-to-receive-all-logs-based-on-timestamp/195241 "2019-08-15T00:17:31Z")
Hi guys Let say from beat i have this below log naming Record(timestamp).log Record(timestamp).log Complete Example for log file name: Record-20190814.log And this log file will be created base on daily basis. Is t… --- ## [Split Module Multiple If Else Statements](https://discuss.elastic.co/t/split-module-multiple-if-else-statements/195275)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 1\ **Last updated:** [August 14, 2019, 11:22pm UTC](https://discuss.elastic.co/t/split-module-multiple-if-else-statements/195275 "2019-08-14T23:22:30Z")
I've been trying to ingest audit cloud logs, and they contain multiple arrays of objects. It's a mess. I've been trying to use the split module in Logstash, but I'm not sure if this is the best way of doing it. I search… --- ## [Read mode and max\_open\_file](https://discuss.elastic.co/t/read-mode-and-max-open-file/195261)
**Author:** [@leeyu](https://discuss.elastic.co/u/leeyu)\ **Replies:** 2\ **Last updated:** [August 14, 2019, 9:24pm UTC](https://discuss.elastic.co/t/read-mode-and-max-open-file/195261 "2019-08-14T21:24:48Z")
Hi all, Does read mode have any protection against reaching the max open file limit? Thanks. --- ## [Resources to learn ruby for use in logstash](https://discuss.elastic.co/t/resources-to-learn-ruby-for-use-in-logstash/195247)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [August 14, 2019, 5:56pm UTC](https://discuss.elastic.co/t/resources-to-learn-ruby-for-use-in-logstash/195247 "2019-08-14T17:56:29Z")
Looking for a path to knowledge.... I don't know Ruby, but if I study a "Ruby for Dummies" type book, it probably won't have any specifics for logstash and will probably teach things never used in logstash. I think I'm… --- ## [Need help with "logstash-input-okta\_enterprise" plugin](https://discuss.elastic.co/t/need-help-with-logstash-input-okta-enterprise-plugin/195246)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 0\ **Last updated:** [August 14, 2019, 5:32pm UTC](https://discuss.elastic.co/t/need-help-with-logstash-input-okta-enterprise-plugin/195246 "2019-08-14T17:32:43Z")
I am not that familiar with ruby but I did manage to build the jruby gem. That one did not work and I am going to try again to get this plugin installed. I am hoping for guidance on a few steps to set up this plugin. I… --- ## [Including space / multiple entries with GROK](https://discuss.elastic.co/t/including-space-multiple-entries-with-grok/195217)
**Author:** [@cjb312](https://discuss.elastic.co/u/cjb312)\ **Replies:** 4\ **Last updated:** [August 14, 2019, 4:45pm UTC](https://discuss.elastic.co/t/including-space-multiple-entries-with-grok/195217 "2019-08-14T16:45:34Z")
So I'm using GROK to clean up some log files into Kibana but there's a couple areas im struggling with. How can get the value of to a field?: X-FORWARDED-FOR -\> (ip address) Also I have another instance of multiple em… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=491) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=493)