# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=512 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 513 --- ## [How to measure time from mysql query to output in elasticsearch?](https://discuss.elastic.co/t/how-to-measure-time-from-mysql-query-to-output-in-elasticsearch/190003)
**Author:** [@Igorr](https://discuss.elastic.co/u/Igorr)\ **Replies:** 0\ **Last updated:** [July 11, 2019, 12:07pm UTC](https://discuss.elastic.co/t/how-to-measure-time-from-mysql-query-to-output-in-elasticsearch/190003 "2019-07-11T12:07:10Z")
How to measure time from mysql query to output in elasticsearch. What best way for these measure? --- ## [How to run Logstash as a service on Windows](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-on-windows/189801)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 3\ **Last updated:** [July 11, 2019, 10:39am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-on-windows/189801 "2019-07-11T10:39:10Z")
Hello, I'm configuring Logstash on windows server. And I need logstash to run as a service and not from command line. And I assume service is configured with an .exe file as binary and not other files like .bat or .ps1.… --- ## [Setting up Secure connection between Filebeat and Logstash](https://discuss.elastic.co/t/setting-up-secure-connection-between-filebeat-and-logstash/189959)
**Author:** [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\ **Replies:** 0\ **Last updated:** [July 11, 2019, 9:48am UTC](https://discuss.elastic.co/t/setting-up-secure-connection-between-filebeat-and-logstash/189959 "2019-07-11T09:48:27Z")
Elastic stack version: 7.2.0 I want to setup a secure connection. First, I generated the certificates with: bin/elasticsearch-certutil Got : ca.crt, instance.crt, instance.key Then set filebeat.yml output.logstash… --- ## [Get data from Hadoop to Elasticsearch DB](https://discuss.elastic.co/t/get-data-from-hadoop-to-elasticsearch-db/189948)
**Author:** [@Pikapi](https://discuss.elastic.co/u/Pikapi)\ **Replies:** 0\ **Last updated:** [July 11, 2019, 9:11am UTC](https://discuss.elastic.co/t/get-data-from-hadoop-to-elasticsearch-db/189948 "2019-07-11T09:11:26Z")
How do i get data from Hadoop cluster into Elasticsearch DB? What should the Logstash Config File contain? --- ## [Error: Exiting: No paths were defined for input accessing config](https://discuss.elastic.co/t/error-exiting-no-paths-were-defined-for-input-accessing-config/189944)
**Author:** [@dhiraj07](https://discuss.elastic.co/u/dhiraj07)\ **Replies:** 0\ **Last updated:** [July 11, 2019, 8:49am UTC](https://discuss.elastic.co/t/error-exiting-no-paths-were-defined-for-input-accessing-config/189944 "2019-07-11T08:49:30Z")
Dear Tem, I am unable to start filebeat. Here is my Configuration File: #============================= Filebeat modules =============================== filebeat.config.modules: Glob pattern for configuration loading … --- ## [How to configure logstash in docker](https://discuss.elastic.co/t/how-to-configure-logstash-in-docker/189938)
**Author:** [@quangvublog](https://discuss.elastic.co/u/quangvublog)\ **Replies:** 0\ **Last updated:** [July 11, 2019, 8:22am UTC](https://discuss.elastic.co/t/how-to-configure-logstash-in-docker/189938 "2019-07-11T08:22:07Z")
Hello everyone! I am having some problem when delploying logstash in docker. When I run container and go inside, I don't see /etc/logstash/ directory. How can I configure inputs, filters, and outputs? --- ## [Jmx plugin 6.8 vs Fixnum/Bignum](https://discuss.elastic.co/t/jmx-plugin-6-8-vs-fixnum-bignum/189686)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [July 11, 2019, 7:47am UTC](https://discuss.elastic.co/t/jmx-plugin-6-8-vs-fixnum-bignum/189686 "2019-07-11T07:47:44Z")
Upgraded logstash from 5.6 to 6.8 and found that the jmx plugin complained like this: /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-jmx-3.0.7/lib/ logstash/inputs/jmx.rb:178: warning: constant ::Fixn… --- ## [Logstash jdbc input plugin schedule doesn't work](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-schedule-doesnt-work/189404)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 9\ **Last updated:** [July 11, 2019, 7:04am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-schedule-doesnt-work/189404 "2019-07-11T07:04:02Z")
Hi everyone, I am trying to run my input plugin at a specific time for example 11:30 AM, but the schedule doesn't work. It passes the time, but doesn't output any logs in the command line. Any idea what is the issue? An… --- ## [No ouput using logstash file plugin](https://discuss.elastic.co/t/no-ouput-using-logstash-file-plugin/189650)
**Author:** [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\ **Replies:** 2\ **Last updated:** [July 11, 2019, 5:28am UTC](https://discuss.elastic.co/t/no-ouput-using-logstash-file-plugin/189650 "2019-07-11T05:28:54Z")
I'm using Windows 10. Logstash 7.2.0 I just want to see the output of filter in console window.. My config c.conf: input { file { path =\> "D:\\Elastic\\logstash-7.2.0\\test\\theLogFile" start\_posit… --- ## [Can't replace real log time with @timestamp](https://discuss.elastic.co/t/cant-replace-real-log-time-with-timestamp/189669)
**Author:** [@Mohammad\_hossein\_Taj](https://discuss.elastic.co/u/Mohammad_hossein_Taj)\ **Replies:** 5\ **Last updated:** [July 11, 2019, 4:26am UTC](https://discuss.elastic.co/t/cant-replace-real-log-time-with-timestamp/189669 "2019-07-11T04:26:48Z")
hi I'm trying to replace my log time with @timestamp but it doesn't work. my log sample: 2019-07-08 01:00:13,564 INFO ir.ac.ut.sdrwebservice.SDRWebService @ batchAddStdDoc, System:G, User:25117, StudentIDs:\[450188215\]… --- ## [Log parsing of TIMeSTAMP Not working as expected](https://discuss.elastic.co/t/log-parsing-of-timestamp-not-working-as-expected/189711)
**Author:** [@cvijaykumarreddy463](https://discuss.elastic.co/u/cvijaykumarreddy463)\ **Replies:** 2\ **Last updated:** [July 11, 2019, 2:57am UTC](https://discuss.elastic.co/t/log-parsing-of-timestamp-not-working-as-expected/189711 "2019-07-11T02:57:36Z")
Please check and give me the solution for it... Sample Data: WARN | wrapper | 2019/06/14 03:17:14 | The "wrapper.java.additional.2" property was redefined on line #84 of configuration file: C:\\Rockwell\\IOServerES\\c… --- ## [GROK - how to strip first five and last four characters from the field](https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689)
**Author:** [@mudricd](https://discuss.elastic.co/u/mudricd)\ **Replies:** 2\ **Last updated:** [July 11, 2019, 2:35am UTC](https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689 "2019-07-11T02:35:46Z")
Hi, I am trying to strip first five and last four characters from the log. This is the log: // "7AFA267A-E3C5-753F-DF422B36C7D07B80 - func\_doTopup.cfm: 87 ms" "7AFA267A-E3C5-753F-DF422B36C7D07B80 - func\_doTopup.cfm: … --- ## [Stuck at Successfully started Logstash API endpoint {:port=\>9600} (can’t load data in Kibana/ElasticSearch)](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9600-can-t-load-data-in-kibana-elasticsearch/189830)
**Author:** [@LL22](https://discuss.elastic.co/u/LL22)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 1:36am UTC](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9600-can-t-load-data-in-kibana-elasticsearch/189830 "2019-07-11T01:36:58Z")
Hello, I'm new to ELK and I'm having an issue to load my data Here is my imput file (it's just to test, it won't remain that empty) input { file { codec =\> json path =\> "/home/Json\_Data/\*.json" start\_position =\> "… --- ## [Logstash Indices](https://discuss.elastic.co/t/logstash-indices/189855)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [July 10, 2019, 8:29pm UTC](https://discuss.elastic.co/t/logstash-indices/189855 "2019-07-10T20:29:11Z")
What is the best way to take 1 datastream, 1 input and run 2 parallel filters out of it for 2 different indices . --- ## [Send info of the ossec agent direct to logstash](https://discuss.elastic.co/t/send-info-of-the-ossec-agent-direct-to-logstash/189851)
**Author:** [@Camilo\_Franco](https://discuss.elastic.co/u/Camilo_Franco)\ **Replies:** 1\ **Last updated:** [July 10, 2019, 7:40pm UTC](https://discuss.elastic.co/t/send-info-of-the-ossec-agent-direct-to-logstash/189851 "2019-07-10T19:40:42Z")
hi , i trying send logs of the ossec agent to logstash directly, my question is ,¿ is necessary the server ossec for send logs ? , and is possible send logs directly ossec agent to logstashg without install server ossec… --- ## [Aggregate filter plugin events not adding to elasticsearch index](https://discuss.elastic.co/t/aggregate-filter-plugin-events-not-adding-to-elasticsearch-index/189610)
**Author:** [@rohith1570](https://discuss.elastic.co/u/rohith1570)\ **Replies:** 8\ **Last updated:** [July 10, 2019, 6:38pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-events-not-adding-to-elasticsearch-index/189610 "2019-07-10T18:38:26Z")
Hi, In stdout i'm able to see the Aggregate events got printed, but not able to see in elasticsearch index. logstash conf: filter { if \[user.id\] != "" and \[user.id\] != 'null' and \[user.id\] != 'error' { aggrega… --- ## [Stuck at Successfully started Logstash API endpoint {:port=\>9600} (can't load data in Kibana/ElasticSearch)](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9600-cant-load-data-in-kibana-elasticsearch/189822)
**Author:** [@luc1](https://discuss.elastic.co/u/luc1)\ **Replies:** 1\ **Last updated:** [July 10, 2019, 4:13pm UTC](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9600-cant-load-data-in-kibana-elasticsearch/189822 "2019-07-10T16:13:26Z")
Hello, I'm new to ELK and I'm having an issue to load my data Here is my imput file (it's just to test, it won't remain that empty) input { file { codec =\> json path =\> "/home/Json\_Data/\*.json" start\_position =\> "… --- ## [Install dependencies in the docker container](https://discuss.elastic.co/t/install-dependencies-in-the-docker-container/186506)
**Author:** [@thomas.heuberger](https://discuss.elastic.co/u/thomas.heuberger)\ **Replies:** 1\ **Last updated:** [July 10, 2019, 3:43pm UTC](https://discuss.elastic.co/t/install-dependencies-in-the-docker-container/186506 "2019-07-10T15:43:25Z")
I'm new to docker and I'm struggling a bit with installing the required prerequisites. I have this in my docker-composer.yml file, because I need the sflow plugin and I need the mysql jdbc driver: command: \> bash -c … --- ## [Logstash launching issue imput file](https://discuss.elastic.co/t/logstash-launching-issue-imput-file/189776)
**Author:** [@luc1](https://discuss.elastic.co/u/luc1)\ **Replies:** 8\ **Last updated:** [July 10, 2019, 3:15pm UTC](https://discuss.elastic.co/t/logstash-launching-issue-imput-file/189776 "2019-07-10T15:15:14Z")
I'm trying to use logstash on json files but after running the following command : sudo /usr/share/logstash/bin/logstash -f lucasFilter.conf the command seems correct I get this error : \[ERROR\] 2019-07-10 13:10:55.6… --- ## [Kv - Drop messages that doesnt match](https://discuss.elastic.co/t/kv-drop-messages-that-doesnt-match/189757)
**Author:** [@PeterH](https://discuss.elastic.co/u/PeterH)\ **Replies:** 3\ **Last updated:** [July 10, 2019, 2:35pm UTC](https://discuss.elastic.co/t/kv-drop-messages-that-doesnt-match/189757 "2019-07-10T14:35:55Z")
Hi, i want to split up messages with that format with the kv filter plugin: "key1": "value1", "key2": "value2", "key3": "value3" This is my kv config: kv { trim\_value =\> """ trim\_key =\> ""\\ ()" field\_split =\> "," … --- ## [CANNOT push logs to LOGSTASH from FILEBEAT](https://discuss.elastic.co/t/cannot-push-logs-to-logstash-from-filebeat/188504)
**Author:** [@Sundaramoorthy\_Anand](https://discuss.elastic.co/u/Sundaramoorthy_Anand)\ **Replies:** 3\ **Last updated:** [July 10, 2019, 2:00pm UTC](https://discuss.elastic.co/t/cannot-push-logs-to-logstash-from-filebeat/188504 "2019-07-10T14:00:38Z")
My filebeat is in the client server but in same domain and ELK stack in another server with their default ports. elasticsearch.yml xpack.security.enabled : false discovery.type: single-node network.host: 16.XXX.YYY.ZZZ… --- ## [Pushing data to elasticsearch through logstash](https://discuss.elastic.co/t/pushing-data-to-elasticsearch-through-logstash/189737)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 1\ **Last updated:** [July 10, 2019, 1:57pm UTC](https://discuss.elastic.co/t/pushing-data-to-elasticsearch-through-logstash/189737 "2019-07-10T13:57:54Z")
hi guys i am new to the ELK stack , so i've created a configuration file but when i run it a get these problems --- ## [Logstash mutate gsub replace json key](https://discuss.elastic.co/t/logstash-mutate-gsub-replace-json-key/189681)
**Author:** [@Suhee\_Kim](https://discuss.elastic.co/u/Suhee_Kim)\ **Replies:** 1\ **Last updated:** [July 10, 2019, 12:23pm UTC](https://discuss.elastic.co/t/logstash-mutate-gsub-replace-json-key/189681 "2019-07-10T12:23:46Z")
Hi, I have been trying to replace '-' to '\_' like this, { "hello-world" : "something" } -\> { "hello\_world" : "something" } this is my setting for logstash input { stdin { codec =\> json } } filter { json { sour… --- ## [Fields added when input is file, but not when input is filebeats](https://discuss.elastic.co/t/fields-added-when-input-is-file-but-not-when-input-is-filebeats/188985)
**Author:** [@zenluiz](https://discuss.elastic.co/u/zenluiz)\ **Replies:** 2\ **Last updated:** [July 10, 2019, 11:17am UTC](https://discuss.elastic.co/t/fields-added-when-input-is-file-but-not-when-input-is-filebeats/188985 "2019-07-10T11:17:18Z")
Hi, I'm reading some weird log files and managed to extract the information I want using grok and kv. However, at the end I want to replace the message field with a simpler message, using fields from the grok plugin. Wh… --- ## [Connect logstash to Kafka with SSL throws error](https://discuss.elastic.co/t/connect-logstash-to-kafka-with-ssl-throws-error/189732)
**Author:** [@PraveenKumar\_KG](https://discuss.elastic.co/u/PraveenKumar_KG)\ **Replies:** 0\ **Last updated:** [July 10, 2019, 11:09am UTC](https://discuss.elastic.co/t/connect-logstash-to-kafka-with-ssl-throws-error/189732 "2019-07-10T11:09:12Z")
Hi , Logstash version : logstash-6.6.1 I am trying to connect logstash with kafka input plugin having SSL enabled input { kafka{ group\_id =\> "logstash-consumer-group-local" topics =\> \["topic"\] bootstrap\_servers =\> "\ **Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 0\ **Last updated:** [July 10, 2019, 10:00am UTC](https://discuss.elastic.co/t/additonal-new-fields-getting-recorded-in-the-log-file/189708 "2019-07-10T10:00:48Z") HI Team, I have been working with ELK components for quite sometime now, however i observe a very strange behaviour with logstash component now. I been working on setup where i have started logging some api logs message… --- ## [Pattern for SSH auth not match](https://discuss.elastic.co/t/pattern-for-ssh-auth-not-match/189670)
**Author:** [@Dave\_Hafid](https://discuss.elastic.co/u/Dave_Hafid)\ **Replies:** 0\ **Last updated:** [July 10, 2019, 6:48am UTC](https://discuss.elastic.co/t/pattern-for-ssh-auth-not-match/189670 "2019-07-10T06:48:53Z")
Dear ALL, i facing some issue when try to create pattern for ssh auth from file /var/log/secure this is line i want to create pattern, Jul 8 18:43:05 masternode sshd\[18144\]: pam\_unix(sshd:auth): authentication failure… --- ## [Logstash 7.0.1 Netflow Module Setup Dashboards and Indices Template fails to setup](https://discuss.elastic.co/t/logstash-7-0-1-netflow-module-setup-dashboards-and-indices-template-fails-to-setup/184022)
**Author:** [@cknoell](https://discuss.elastic.co/u/cknoell)\ **Replies:** 1\ **Last updated:** [July 10, 2019, 8:37am UTC](https://discuss.elastic.co/t/logstash-7-0-1-netflow-module-setup-dashboards-and-indices-template-fails-to-setup/184022 "2019-07-10T08:37:34Z")
Hi, we are having an issue with the Logstash Netflow Module trying to run the --setup command to install the Dashboards und Indices Templates in an X-Pack secured environment, which is running in a DARK network environme… --- ## [ERROR on fetching data from mysql db using jdbc logstash plugin](https://discuss.elastic.co/t/error-on-fetching-data-from-mysql-db-using-jdbc-logstash-plugin/189683)
**Author:** [@kumaram](https://discuss.elastic.co/u/kumaram)\ **Replies:** 0\ **Last updated:** [July 10, 2019, 7:53am UTC](https://discuss.elastic.co/t/error-on-fetching-data-from-mysql-db-using-jdbc-logstash-plugin/189683 "2019-07-10T07:53:10Z")
When I try to fetch data from mysql using jdbc logstash plugin, I'm facing below error :exception=\>#\ It is happening with a particular table only , working for … --- ## [Last\_run\_metadata\_path file is not updating but sql\_last\_value is changing in every scheduled time](https://discuss.elastic.co/t/last-run-metadata-path-file-is-not-updating-but-sql-last-value-is-changing-in-every-scheduled-time/189682)
**Author:** [@avinash9999](https://discuss.elastic.co/u/avinash9999)\ **Replies:** 0\ **Last updated:** [July 10, 2019, 7:42am UTC](https://discuss.elastic.co/t/last-run-metadata-path-file-is-not-updating-but-sql-last-value-is-changing-in-every-scheduled-time/189682 "2019-07-10T07:42:55Z")
I have my logstash setup on linux server. I have made two config files, One file is for pulling the entire records from sql server table and other file just update the the new changes. When I run the first file manuall… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=511) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=513)