# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=502 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 503 --- ## [How to manage different timezone](https://discuss.elastic.co/t/how-to-manage-different-timezone/192867)
**Author:** [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\ **Replies:** 1\ **Last updated:** [July 30, 2019, 1:59pm UTC](https://discuss.elastic.co/t/how-to-manage-different-timezone/192867 "2019-07-30T13:59:34Z")
Hi, I'm uploading IoT data via logstash to elasticsearch. The data comes from machines that have a datetime with different time zones. I realized that the time is changed by the local timezone (the time is moved forward… --- ## [What is the purpose of setting "thread" value in heartbeat plugin?](https://discuss.elastic.co/t/what-is-the-purpose-of-setting-thread-value-in-heartbeat-plugin/192605)
**Author:** [@garima](https://discuss.elastic.co/u/garima)\ **Replies:** 1\ **Last updated:** [July 30, 2019, 12:48pm UTC](https://discuss.elastic.co/t/what-is-the-purpose-of-setting-thread-value-in-heartbeat-plugin/192605 "2019-07-30T12:48:23Z")
Hi Team, \[Using Logstash version: 6.4.1\] I have some queries regarding heartbeat plugin. I have configured heartbeat plugin with "threads" parameter, as per the specification mentioned on elastic official site, Kindly… --- ## [KV Plugin Not working](https://discuss.elastic.co/t/kv-plugin-not-working/192188)
**Author:** [@premkumar](https://discuss.elastic.co/u/premkumar)\ **Replies:** 8\ **Last updated:** [July 30, 2019, 9:20am UTC](https://discuss.elastic.co/t/kv-plugin-not-working/192188 "2019-07-30T09:20:53Z")
Hi All, I have been trying to extract key value pairs from a certain log message. Log Message Sample a=a1, b=b1, c=c1, d=d1,d2, e=e1 hello world, f=f1 Expected Output a=a1 b=b1 c=c1 d=d1,d2 e=e1 f=f1 Actual Ou… --- ## [Uniform Time Formats](https://discuss.elastic.co/t/uniform-time-formats/192678)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 5\ **Last updated:** [July 30, 2019, 4:56am UTC](https://discuss.elastic.co/t/uniform-time-formats/192678 "2019-07-30T04:56:33Z")
I have the following 2 fields with different formats in the input. End Time: 2019-07-26 00:00:05,580 Start Time: 2019-07-26T00:00:02.678+02:100: I want them to be formatted to a uniform timestamp say YYYY-MM-dd HH:mm:… --- ## [Logstash XML parsing issues - trying to send to Graylog](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog/192790)
**Author:** [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\ **Replies:** 1\ **Last updated:** [July 30, 2019, 4:20am UTC](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog/192790 "2019-07-30T04:20:09Z")
Hi, I would like to parse some NetApp CIFS share audit log XML files, but they are an ugly format that I don't have control over (below): \ \ \… --- ## [Retrieve multiple documents in elasticsearch filter](https://discuss.elastic.co/t/retrieve-multiple-documents-in-elasticsearch-filter/192751)
**Author:** [@jdcohen220](https://discuss.elastic.co/u/jdcohen220)\ **Replies:** 2\ **Last updated:** [July 29, 2019, 7:31pm UTC](https://discuss.elastic.co/t/retrieve-multiple-documents-in-elasticsearch-filter/192751 "2019-07-29T19:31:50Z")
Hi, Is it possible to retrieve multiple elasticsearch documents from a query using the elasticsearch filter plugin? All the docs show use cases with a single log document. --- ## [Logstash consuming too much bandwidth](https://discuss.elastic.co/t/logstash-consuming-too-much-bandwidth/190593)
**Author:** [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)\ **Replies:** 11\ **Last updated:** [July 29, 2019, 5:17pm UTC](https://discuss.elastic.co/t/logstash-consuming-too-much-bandwidth/190593 "2019-07-29T17:17:08Z")
Hello, I am sending logs from filebeat to Logstash and then from logstash to ElasticSearch. The problem is Logstash is consuming too much bandwidth.I have attached network usage graph of logstash server. (green is inc… --- ## [\[ERROR\]logstash.pipeline - the trustAnchors parameter must be non-empty](https://discuss.elastic.co/t/error-logstash-pipeline-the-trustanchors-parameter-must-be-non-empty/192485)
**Author:** [@victor\_ide](https://discuss.elastic.co/u/victor_ide)\ **Replies:** 1\ **Last updated:** [July 29, 2019, 2:34pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-the-trustanchors-parameter-must-be-non-empty/192485 "2019-07-29T14:34:52Z")
Hey guys, I'm trying to create different indexes based on a field added using the processors. So in the winlogbeat file I added the fields: processors: add\_tags: tags: \[internal, lab\] target: "environment" And I'… --- ## [Json of varying length and multiline](https://discuss.elastic.co/t/json-of-varying-length-and-multiline/191689)
**Author:** [@Shipper01](https://discuss.elastic.co/u/Shipper01)\ **Replies:** 16\ **Last updated:** [July 29, 2019, 2:21pm UTC](https://discuss.elastic.co/t/json-of-varying-length-and-multiline/191689 "2019-07-29T14:21:25Z")
I'm very new to everything elastic, logstash and json. I was able to stand everything up and ingest one set of logs and query on them in kibana. My second data set is a json file whose fields vary from message to messa… --- ## [Remove characters \[0;37m , \[0;33m and \[0m from logstash output](https://discuss.elastic.co/t/remove-characters-0-37m-0-33m-and-0m-from-logstash-output/192722)
**Author:** [@science162](https://discuss.elastic.co/u/science162)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 2:17pm UTC](https://discuss.elastic.co/t/remove-characters-0-37m-0-33m-and-0m-from-logstash-output/192722 "2019-07-29T14:17:32Z")
Hello, after configuring my simple logstash.conf with input stdin and output stdout, I always get a duty output with input : dhschggdsgg output : { "host"←\[0;37m =\> ←\[0m←\[0;33m"hostname"←\[0m, "message"←\[0;37m =\> ←\[… --- ## [Reading data from redis server into logstash input](https://discuss.elastic.co/t/reading-data-from-redis-server-into-logstash-input/192673)
**Author:** [@Madhu\_Neal1](https://discuss.elastic.co/u/Madhu_Neal1)\ **Replies:** 1\ **Last updated:** [July 29, 2019, 1:56pm UTC](https://discuss.elastic.co/t/reading-data-from-redis-server-into-logstash-input/192673 "2019-07-29T13:56:00Z")
Team, Greeting of the day! I like know how to read values which are saved in redis-server under the key and I have an input setting like this: input { redis { host =\> "127.0.0.1" # these settings should match the o… --- ## [Replacing @timestamp with actual logtime](https://discuss.elastic.co/t/replacing-timestamp-with-actual-logtime/192683)
**Author:** [@mkaruza](https://discuss.elastic.co/u/mkaruza)\ **Replies:** 5\ **Last updated:** [July 29, 2019, 1:50pm UTC](https://discuss.elastic.co/t/replacing-timestamp-with-actual-logtime/192683 "2019-07-29T13:50:37Z")
Hi everyone :slight\_smile: This is my first post here - I'm a rookie in Elasticstack and would really appreciate your help since obviously what I'm doing isn't working. I am trying to replace @timestamp with actual time… --- ## [Selectively download StackDriver files from google storage buckets with google input plugin](https://discuss.elastic.co/t/selectively-download-stackdriver-files-from-google-storage-buckets-with-google-input-plugin/192709)
**Author:** [@maineffort](https://discuss.elastic.co/u/maineffort)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 1:31pm UTC](https://discuss.elastic.co/t/selectively-download-stackdriver-files-from-google-storage-buckets-with-google-input-plugin/192709 "2019-07-29T13:31:03Z")
I'd like to selectively download StackDriver log files from google storage bucket. The bucket is created for forwarding StackDriver logs and is therefore arranged in a directory fashion i.e. logs-bucket/cloudaudit.googl… --- ## [HOW TO HAVE A CLEAN OUTPUT WITH RUBY DEBUG?](https://discuss.elastic.co/t/how-to-have-a-clean-output-with-ruby-debug/192707)
**Author:** [@science162](https://discuss.elastic.co/u/science162)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 1:30pm UTC](https://discuss.elastic.co/t/how-to-have-a-clean-output-with-ruby-debug/192707 "2019-07-29T13:30:20Z")
Hello, after configuring my simple logstash.conf with input stdin and output stdout, I always get a duty output with input : dhschggdsgg output : { "host"←\[0;37m =\> ←\[0m←\[0;33m"hostname"←\[0m, "message"←\[0;37m =\> ←\[… --- ## [HTTP Plugin and document update](https://discuss.elastic.co/t/http-plugin-and-document-update/192695)
**Author:** [@Christophe\_Cosnefroy](https://discuss.elastic.co/u/Christophe_Cosnefroy)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 12:31pm UTC](https://discuss.elastic.co/t/http-plugin-and-document-update/192695 "2019-07-29T12:31:06Z")
I'm using Logstash and http plugin in order to insert documents to ElasticSearch and it's work fine. But I would like to update documents instead of insert them. Does someone can help me? --- ## [(LoadError) no such file to load -- gssapi](https://discuss.elastic.co/t/loaderror-no-such-file-to-load-gssapi/192619)
**Author:** [@Darshan\_Parab](https://discuss.elastic.co/u/Darshan_Parab)\ **Replies:** 1\ **Last updated:** [July 29, 2019, 12:25pm UTC](https://discuss.elastic.co/t/loaderror-no-such-file-to-load-gssapi/192619 "2019-07-29T12:25:34Z")
Hi, I have configured webhdfs output as show below. I'm getting error that says I don't have gssapi conf webhdfs output. Pipeline: input { beats { port =\> 5044 } } filter { } output { webhdfs { host =\> "hdfs… --- ## [Logstash is not able to ingest data into elastic search after 1-2 hours of time span?](https://discuss.elastic.co/t/logstash-is-not-able-to-ingest-data-into-elastic-search-after-1-2-hours-of-time-span/191845)
**Author:** [@ldeepak](https://discuss.elastic.co/u/ldeepak)\ **Replies:** 5\ **Last updated:** [July 29, 2019, 11:01am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-ingest-data-into-elastic-search-after-1-2-hours-of-time-span/191845 "2019-07-29T11:01:30Z")
what should be the possible, as i have already checked below points. No connection issue. No error message received at log stash. I have tried to sending logs from a separate log file it is getting transferred success… --- ## [Logstash/Elastic slow indexing](https://discuss.elastic.co/t/logstash-elastic-slow-indexing/192388)
**Author:** [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Replies:** 1\ **Last updated:** [July 29, 2019, 10:47am UTC](https://discuss.elastic.co/t/logstash-elastic-slow-indexing/192388 "2019-07-29T10:47:57Z")
Hello, I am new to ELK and maybe my problem is dumm, but i cant get over it. I have very slow indexing( approx: 4k docs per min. sometimes its 8k) My setup - Centos 7 - Logstash 7.2 - Elastic 7.2 - Kibana 7.2 - (ELK a… --- ## [Java codec plugins use kafka input error](https://discuss.elastic.co/t/java-codec-plugins-use-kafka-input-error/192346)
**Author:** [@zhi\_asher](https://discuss.elastic.co/u/zhi_asher)\ **Replies:** 3\ **Last updated:** [July 29, 2019, 10:46am UTC](https://discuss.elastic.co/t/java-codec-plugins-use-kafka-input-error/192346 "2019-07-29T10:46:35Z")
@danhermann ，hello，I used the example you supplyed in “https://www.elastic.co/guide/en/logstash/current/java-codec-plugin.html”，and success get the result by the java\_stdin。However，when i set input from kafka，I got the e… --- ## [Logstash shuts down within some seconds after starting up](https://discuss.elastic.co/t/logstash-shuts-down-within-some-seconds-after-starting-up/192609)
**Author:** [@pharshil9697](https://discuss.elastic.co/u/pharshil9697)\ **Replies:** 11\ **Last updated:** [July 29, 2019, 10:16am UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-some-seconds-after-starting-up/192609 "2019-07-29T10:16:29Z")
Hi all, I am trying to run a log file, but after instantiating logstash suddenly stops. Logstash 7.2.0 Error Log : \`\[2019-07-29T11:59:28,765\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipelines.ym… --- ## [Deactivate ssl validation on monitoring output](https://discuss.elastic.co/t/deactivate-ssl-validation-on-monitoring-output/192044)
**Author:** [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Replies:** 1\ **Last updated:** [July 29, 2019, 10:11am UTC](https://discuss.elastic.co/t/deactivate-ssl-validation-on-monitoring-output/192044 "2019-07-29T10:11:14Z")
Hello, due to a creation error in the Keys for the Elasticsearch HTTP SSL, i must deactivate ssl\_certificate validation on all clients that are connecting to elasticsearch directly. At the moment i can not recreate the… --- ## [Logstash upgrade 5.6.8 to 6.6.2 no new message into es](https://discuss.elastic.co/t/logstash-upgrade-5-6-8-to-6-6-2-no-new-message-into-es/192666)
**Author:** [@mingv5](https://discuss.elastic.co/u/mingv5)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 9:59am UTC](https://discuss.elastic.co/t/logstash-upgrade-5-6-8-to-6-6-2-no-new-message-into-es/192666 "2019-07-29T09:59:36Z")
I upgrade elastic-stack from 5.6.8 to 6.6.2,there is no new messages into elasticsearch indices . When I just rollback logstash to 5.6.8 use the same configuration file than elk is work I try to delete index template D… --- ## [Grokparsefailure in Logstash output](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190)
**Author:** [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\ **Replies:** 4\ **Last updated:** [July 29, 2019, 9:35am UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190 "2019-07-29T09:35:56Z")
So I was trying to ingest nginx log to my logstash and after several attempts to solve this I am exhausted now. Grok is properly working in the debugger but whenever I put that into logtstash \_grokparsefailure occurs. An… --- ## [After add\_field, conversion from string to float unsuccessful](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428)
**Author:** [@rj23495](https://discuss.elastic.co/u/rj23495)\ **Replies:** 8\ **Last updated:** [July 29, 2019, 6:12am UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428 "2019-07-29T06:12:43Z")
filter { grok { match =\> { "message" =\> "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec} \\\[%{DATA:pool}\\\] %{DATA:metric} %{DATA:metricname} %{DATA:datatype} %{NUMBER:metricvalue:fl… --- ## [SQL statement with an union](https://discuss.elastic.co/t/sql-statement-with-an-union/192641)
**Author:** [@Krypton8](https://discuss.elastic.co/u/Krypton8)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 8:20am UTC](https://discuss.elastic.co/t/sql-statement-with-an-union/192641 "2019-07-29T08:20:03Z")
Hello, I'm trying to retrieve data from a database using a SQL statement in Logstash with an union in it. The problem is, logstash only execute the first request and ignore the second request after the 'UNION'. The re… --- ## [Problem with Cloudwatch Input Login for ECS Namespace](https://discuss.elastic.co/t/problem-with-cloudwatch-input-login-for-ecs-namespace/192629)
**Author:** [@SammyJumpstart23](https://discuss.elastic.co/u/SammyJumpstart23)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 7:54am UTC](https://discuss.elastic.co/t/problem-with-cloudwatch-input-login-for-ecs-namespace/192629 "2019-07-29T07:54:48Z")
Hello! I've been trying to poll for Cloudwatch metrics from AWS ECS Fargate to our Elastic Cloud to have everything centralized in terms of alerting and monitoring. However, with the current configuration, no indices ar… --- ## [Prioritize an host over the others](https://discuss.elastic.co/t/prioritize-an-host-over-the-others/192623)
**Author:** [@Nonow53](https://discuss.elastic.co/u/Nonow53)\ **Replies:** 1\ **Last updated:** [July 29, 2019, 7:41am UTC](https://discuss.elastic.co/t/prioritize-an-host-over-the-others/192623 "2019-07-29T07:41:03Z")
Hello, When I define a multiple hosts list in the elasticsearch output plugin, is it possible to prioritize one host over the others ? Can I affect a weight in order to redistribute essentially to one specific node and… --- ## [Official support for Java Filter Plugin API](https://discuss.elastic.co/t/official-support-for-java-filter-plugin-api/192607)
**Author:** [@mdobrin](https://discuss.elastic.co/u/mdobrin)\ **Replies:** 0\ **Last updated:** [July 29, 2019, 6:42am UTC](https://discuss.elastic.co/t/official-support-for-java-filter-plugin-api/192607 "2019-07-29T06:42:10Z")
From what version of Logstash is the Java plugin API officially supported (i.e. beyond Beta)? --- ## [Input codec=\>multiline with filter csv not behaving as expected](https://discuss.elastic.co/t/input-codec-multiline-with-filter-csv-not-behaving-as-expected/192545)
**Author:** [@prawsthorne](https://discuss.elastic.co/u/prawsthorne)\ **Replies:** 4\ **Last updated:** [July 28, 2019, 2:58pm UTC](https://discuss.elastic.co/t/input-codec-multiline-with-filter-csv-not-behaving-as-expected/192545 "2019-07-28T14:58:51Z")
I'm wanting to input a poorly formatted csv file into elasticsearch. The csv file is an indexer-csv from nutch 1.15. The file has rows as follows; http://blackseamap.com/bshome/feed/,Comments on: Black Sea Home,"Comment… --- ## [Pre-Index a field during Index Creation](https://discuss.elastic.co/t/pre-index-a-field-during-index-creation/192559)
**Author:** [@mrashid](https://discuss.elastic.co/u/mrashid)\ **Replies:** 0\ **Last updated:** [July 28, 2019, 10:36am UTC](https://discuss.elastic.co/t/pre-index-a-field-during-index-creation/192559 "2019-07-28T10:36:00Z")
I can understand that its possible to preindex a field during index creation as mentioned in the following page : https://www.elastic.co/guide/en/elasticsearch/reference/master/index-modules-index-sorting.html In my ca… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=501) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=503)