# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=518 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 519 --- ## [Replace @timestamp with log's time Somebody help me please](https://discuss.elastic.co/t/replace-timestamp-with-logs-time-somebody-help-me-please/187705)
**Author:** [@anhdt061091](https://discuss.elastic.co/u/anhdt061091)\ **Replies:** 17\ **Last updated:** [July 2, 2019, 2:10am UTC](https://discuss.elastic.co/t/replace-timestamp-with-logs-time-somebody-help-me-please/187705 "2019-07-02T02:10:33Z")
Hi everyone I used logstash and elasticsearch 6.5 and i want to replace @timestamp to log's time but failed, i don't undertand where i'm wrong . My log format : 2019-06-27 08:55:22 INFO 43665 SMS-MT \[cid:nnx\_smppg… --- ## [\[ERROR\]\[logstash.pipeline\] Error registering plugin when sending cloudwatch logs to my elastic cloud](https://discuss.elastic.co/t/error-logstash-pipeline-error-registering-plugin-when-sending-cloudwatch-logs-to-my-elastic-cloud/188401)
**Author:** [@rhader](https://discuss.elastic.co/u/rhader)\ **Replies:** 4\ **Last updated:** [July 1, 2019, 8:42pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-error-registering-plugin-when-sending-cloudwatch-logs-to-my-elastic-cloud/188401 "2019-07-01T20:42:41Z")
I am running logstash v6.8.1 on an aws ec2 linux 2 ami instance. I have installed logstash successfully. I am using logstash to get logs from aws cloudwatch using this plugin https://github.com/lukewaite/logstash-input-… --- ## [Automatically implementing iLm on new indices](https://discuss.elastic.co/t/automatically-implementing-ilm-on-new-indices/188295)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 11:01am UTC](https://discuss.elastic.co/t/automatically-implementing-ilm-on-new-indices/188295 "2019-07-01T11:01:24Z")
in order to analyze the data daily I am creating indices. But now i want to automatically implement iLm on those newly created indices, for this purpose I have created a new template and added to my logstash .conf file. … --- ## [ELPASED Filter - Works differently 6.8.1 vs 7.1 - Possible Bug?](https://discuss.elastic.co/t/elpased-filter-works-differently-6-8-1-vs-7-1-possible-bug/187400)
**Author:** [@AquaX](https://discuss.elastic.co/u/AquaX)\ **Replies:** 5\ **Last updated:** [July 1, 2019, 2:12pm UTC](https://discuss.elastic.co/t/elpased-filter-works-differently-6-8-1-vs-7-1-possible-bug/187400 "2019-07-01T14:12:58Z")
I have noticed something interesting. I have a configuration that uses the logstash-filter-elapsed plugin (latest version) to get the time difference between two log entries. Log entries: 2019.04.25|09:36:49.850||B8CA… --- ## [Using aggregate filter to measure response time](https://discuss.elastic.co/t/using-aggregate-filter-to-measure-response-time/188312)
**Author:** [@BartR](https://discuss.elastic.co/u/BartR)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 1:40pm UTC](https://discuss.elastic.co/t/using-aggregate-filter-to-measure-response-time/188312 "2019-07-01T13:40:13Z")
Hi , i have been attempting to create an additional field into my logging which keeps the responsetime of tsa requests to a service . after looking though some stuff i found that it looked like it would be possible wit… --- ## [File input does not work with anything in "/var/log/elasticsearch/"](https://discuss.elastic.co/t/file-input-does-not-work-with-anything-in-var-log-elasticsearch/188326)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 1:28pm UTC](https://discuss.elastic.co/t/file-input-does-not-work-with-anything-in-var-log-elasticsearch/188326 "2019-07-01T13:28:09Z")
Hi! I'm trying to ingest the logs for Logstash and Elasticsearch (anything above "INFO") which is working great for Logstash logs but it won't register any file in the ES log folder. While I see that it should be doing … --- ## [Not able to create separate fields all log data in message field](https://discuss.elastic.co/t/not-able-to-create-separate-fields-all-log-data-in-message-field/188296)
**Author:** [@Raghu.rajanna](https://discuss.elastic.co/u/Raghu.rajanna)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 1:26pm UTC](https://discuss.elastic.co/t/not-able-to-create-separate-fields-all-log-data-in-message-field/188296 "2019-07-01T13:26:55Z")
I am new to Grock filter tried with grok debugger working fine in it but not able to create new fields all log data are in the message field this is my configuration file. #Windows Firewall input { beats { port =\> … --- ## [Logstash(7.1.1) is not working in windows 2012 R2 server](https://discuss.elastic.co/t/logstash-7-1-1-is-not-working-in-windows-2012-r2-server/187869)
**Author:** [@jagadish\_panda](https://discuss.elastic.co/u/jagadish_panda)\ **Replies:** 5\ **Last updated:** [July 1, 2019, 1:19pm UTC](https://discuss.elastic.co/t/logstash-7-1-1-is-not-working-in-windows-2012-r2-server/187869 "2019-07-01T13:19:22Z")
Hi Team, I am unable to start logstatsh 7.1.1, it got aborted and it does not create the log file. I am getting the below error message - warning: ignoring JAVA\_OPTS= -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitia … --- ## [ERROR: Unknown command 'Logstash'](https://discuss.elastic.co/t/error-unknown-command-logstash/187620)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 9\ **Last updated:** [July 1, 2019, 12:55pm UTC](https://discuss.elastic.co/t/error-unknown-command-logstash/187620 "2019-07-01T12:55:08Z")
Hi I'm new to Logstash and I am following this blog (https://www.elastic.co/blog/logstash-jdbc-input-plugin) to connect postgresql to elasticsearch using logstash, but I am getting this error: logstash-7.2.0/bin/logsta… --- ## [How to read log files using Logstash , where my logs are generated using bunyan/winston in node in the following format ? I am getting this error](https://discuss.elastic.co/t/how-to-read-log-files-using-logstash-where-my-logs-are-generated-using-bunyan-winston-in-node-in-the-following-format-i-am-getting-this-error/187996)
**Author:** [@akshatBais](https://discuss.elastic.co/u/akshatBais)\ **Replies:** 3\ **Last updated:** [July 1, 2019, 12:40pm UTC](https://discuss.elastic.co/t/how-to-read-log-files-using-logstash-where-my-logs-are-generated-using-bunyan-winston-in-node-in-the-following-format-i-am-getting-this-error/187996 "2019-07-01T12:40:22Z")
LOGS TO BE READ BY LOGSTASH IN THE FOLLOWING FORMAT in a log file: {"name":"portal-api","hostname":"vid","pid":10348,"level":30,"msg":"Start fetching","time":"2019-06-28T07:19:49.364Z","v":0} {"name":"portal-api","host… --- ## [Mutli-log output config help](https://discuss.elastic.co/t/mutli-log-output-config-help/187919)
**Author:** [@JB\_Pollard](https://discuss.elastic.co/u/JB_Pollard)\ **Replies:** 3\ **Last updated:** [July 1, 2019, 12:07pm UTC](https://discuss.elastic.co/t/mutli-log-output-config-help/187919 "2019-07-01T12:07:04Z")
I have multiple logs I want to output to a index with the computer name and filename if its from filebeat and with computername if anything else. Not sure on the best way to accomplish below is my attempt however not sur… --- ## [Splitting multiple arrays in Logstash to create multi events](https://discuss.elastic.co/t/splitting-multiple-arrays-in-logstash-to-create-multi-events/187094)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 3\ **Last updated:** [July 1, 2019, 11:57am UTC](https://discuss.elastic.co/t/splitting-multiple-arrays-in-logstash-to-create-multi-events/187094 "2019-07-01T11:57:37Z")
Hi all, I have some array fields with different types as following: f1=\[0,1,2,3,4\] f2=\[a1,a2,a3,a4,a5\] f3=\[06/24/2019 06:02:00.000,06/24/2019 07:02:00.000,06/24/2019 08:02:00.000,06/24/2019 09:02:00.000,06/24/2019 05… --- ## [How delete index before synching data using logstash](https://discuss.elastic.co/t/how-delete-index-before-synching-data-using-logstash/188287)
**Author:** [@arunkvinam](https://discuss.elastic.co/u/arunkvinam)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 10:24am UTC](https://discuss.elastic.co/t/how-delete-index-before-synching-data-using-logstash/188287 "2019-07-01T10:24:33Z")
Iam using logstash input plugin for synch mysql data to elasticsearch . But I have to delete elasticsearch index before synch the data using logstash.Please give me a solution for this --- ## [How to send multiple jenkins job console output to ELK with defferent index name using jenkins logstash plugin](https://discuss.elastic.co/t/how-to-send-multiple-jenkins-job-console-output-to-elk-with-defferent-index-name-using-jenkins-logstash-plugin/188263)
**Author:** [@vijaybhaskar](https://discuss.elastic.co/u/vijaybhaskar)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 8:36am UTC](https://discuss.elastic.co/t/how-to-send-multiple-jenkins-job-console-output-to-elk-with-defferent-index-name-using-jenkins-logstash-plugin/188263 "2019-07-01T08:36:29Z")
Hi, what is the configuration required to send multiple jenkins job console output to ELK with defferent index name using jenkins logstash plugin. Please help on it? Thanks, Vijay --- ## [Error in creating logstash](https://discuss.elastic.co/t/error-in-creating-logstash/188259)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 8:16am UTC](https://discuss.elastic.co/t/error-in-creating-logstash/188259 "2019-07-01T08:16:56Z")
I am trying to create indices for netflow data using the netflow plugins since I have created my own template I am getting error while creating indices: \[WARN \] 2019-07-01 13:44:45.088 \[\[main\]\>worker0\] elasticsearch - C… --- ## [Logstash 7.2.0 in Windows returns java.lang.IllegalStateException (GemspecError) error](https://discuss.elastic.co/t/logstash-7-2-0-in-windows-returns-java-lang-illegalstateexception-gemspecerror-error/188142)
**Author:** [@pappu](https://discuss.elastic.co/u/pappu)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 8:11am UTC](https://discuss.elastic.co/t/logstash-7-2-0-in-windows-returns-java-lang-illegalstateexception-gemspecerror-error/188142 "2019-07-01T08:11:39Z")
I installed logstash 7.2.0 on windows server, by copying .zip file and extracting binaries. When I run the following simple test as suggested in one of the documentation, I see the following. C:\\monitoring\\logstash-7.2.… --- ## [Setting up logstash on a server](https://discuss.elastic.co/t/setting-up-logstash-on-a-server/188164)
**Author:** [@rhader](https://discuss.elastic.co/u/rhader)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 8:02am UTC](https://discuss.elastic.co/t/setting-up-logstash-on-a-server/188164 "2019-07-01T08:02:05Z")
I am attempting to setup logstash on a server so it can receive logs from aws cloudwath anytime of the day. Every single example I have seen though, is with users simply running logstash locally and initiating the proce… --- ## [Index lifecycle management usage](https://discuss.elastic.co/t/index-lifecycle-management-usage/188234)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 7:58am UTC](https://discuss.elastic.co/t/index-lifecycle-management-usage/188234 "2019-07-01T07:58:10Z")
Hi I am using this iLm features to save the space on my system but I am bit confused with its policy. A little help would be very appreciated... I have decided to keep the index in below format HOT Warm - 7 Days from … --- ## [Syslog with tcp-ssl error](https://discuss.elastic.co/t/syslog-with-tcp-ssl-error/188236)
**Author:** [@olivier974](https://discuss.elastic.co/u/olivier974)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 6:04am UTC](https://discuss.elastic.co/t/syslog-with-tcp-ssl-error/188236 "2019-07-01T06:04:32Z")
Hello, I'm trying to configure an systlog output with ssl enabled with the following configuration : syslog { host =\> "my\_ip" port =\> "6514" protocol =\> "ssl-tcp" ssl\_cacert =\> "my\_cert" facility =\> "16" severity… --- ## [How to make Logstash send messages after sync finished?](https://discuss.elastic.co/t/how-to-make-logstash-send-messages-after-sync-finished/188233)
**Author:** [@Yisaer](https://discuss.elastic.co/u/Yisaer)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 5:36am UTC](https://discuss.elastic.co/t/how-to-make-logstash-send-messages-after-sync-finished/188233 "2019-07-01T05:36:50Z")
Hi，I’m using logstash to sync es data daily, and I hope to receive a message(like http request) after each sync finished. How can I make it? --- ## [Index a file line by line in logstash](https://discuss.elastic.co/t/index-a-file-line-by-line-in-logstash/188048)
**Author:** [@Ashish\_Ranjan](https://discuss.elastic.co/u/Ashish_Ranjan)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 5:23am UTC](https://discuss.elastic.co/t/index-a-file-line-by-line-in-logstash/188048 "2019-07-01T05:23:52Z")
I am using logstash to ingest multiple application logs into elasticsearch. I have setup the filter to ingest logs which are working fine. For one application I need to index the log file line by line, without any mappi… --- ## [\_dateparsefailure problem](https://discuss.elastic.co/t/dateparsefailure-problem/188216)
**Author:** [@trx](https://discuss.elastic.co/u/trx)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 1:54am UTC](https://discuss.elastic.co/t/dateparsefailure-problem/188216 "2019-07-01T01:54:55Z")
Hi, I have been trying to replace my @timestamps from my syslog Have used this example: I really don't understand why it's not working! I looked at this topic: And @magnusbaeck gave the following test to the OP to … --- ## [Ther is no output being shown on the command prompt even after clearing .sincedb file](https://discuss.elastic.co/t/ther-is-no-output-being-shown-on-the-command-prompt-even-after-clearing-sincedb-file/186198)
**Author:** [@deepanshu\_goel](https://discuss.elastic.co/u/deepanshu_goel)\ **Replies:** 7\ **Last updated:** [June 30, 2019, 6:55pm UTC](https://discuss.elastic.co/t/ther-is-no-output-being-shown-on-the-command-prompt-even-after-clearing-sincedb-file/186198 "2019-06-30T18:55:41Z")
configuration file: input { file { path=\>"\\E:\\kibana\\logstash-7.1.1\\logstash-7.1.1\\data\\event-data\\apache\_access.log" type =\> "apache-access" start\_position=\> "beginning" } … --- ## [Need advice in logstash to dynamicly output csv file name based on weekly timestamp](https://discuss.elastic.co/t/need-advice-in-logstash-to-dynamicly-output-csv-file-name-based-on-weekly-timestamp/188197)
**Author:** [@aso](https://discuss.elastic.co/u/aso)\ **Replies:** 2\ **Last updated:** [June 30, 2019, 5:48pm UTC](https://discuss.elastic.co/t/need-advice-in-logstash-to-dynamicly-output-csv-file-name-based-on-weekly-timestamp/188197 "2019-06-30T17:48:17Z")
So i'm doing a csv output automation where i want my exported csv file to be named like data-2019.07.01.csv but naming/creating the new file only occur every monday (weekly) so the file will contain data from July 1st-… --- ## [Logstash parsing log multiple times](https://discuss.elastic.co/t/logstash-parsing-log-multiple-times/188196)
**Author:** [@vikassachchan](https://discuss.elastic.co/u/vikassachchan)\ **Replies:** 1\ **Last updated:** [June 30, 2019, 4:49pm UTC](https://discuss.elastic.co/t/logstash-parsing-log-multiple-times/188196 "2019-06-30T16:49:54Z")
I have setup ELK, where i am trying to parse multiple log files. I am transferring the logs file from my production servers to the server where ELK is installed using RSYNC. Now, the problem is logstash is parsing one p… --- ## [Unknown encoding name error](https://discuss.elastic.co/t/unknown-encoding-name-error/188182)
**Author:** [@magician.kim](https://discuss.elastic.co/u/magician.kim)\ **Replies:** 1\ **Last updated:** [June 30, 2019, 11:09am UTC](https://discuss.elastic.co/t/unknown-encoding-name-error/188182 "2019-06-30T11:09:23Z")
Hi, I'm using Logstash 7.2 When i use logstash anything, The error occurs like that... Where can I find this error ? And how can I fix it? --- ## [Reading the log file from the last read position](https://discuss.elastic.co/t/reading-the-log-file-from-the-last-read-position/188131)
**Author:** [@jatin6418](https://discuss.elastic.co/u/jatin6418)\ **Replies:** 2\ **Last updated:** [June 29, 2019, 11:42am UTC](https://discuss.elastic.co/t/reading-the-log-file-from-the-last-read-position/188131 "2019-06-29T11:42:08Z")
Hey i am working on data visulization using kibana. So for that i am reading my log file using logstash but my problem is whenever i click on refresh button in kibana whole log file is read again. But i want to read the… --- ## [Question about multiline](https://discuss.elastic.co/t/question-about-multiline/188134)
**Author:** [@akumo](https://discuss.elastic.co/u/akumo)\ **Replies:** 0\ **Last updated:** [June 29, 2019, 10:25am UTC](https://discuss.elastic.co/t/question-about-multiline/188134 "2019-06-29T10:25:18Z")
Hi. I try to read multiline log from this script. input { file { path =\> "/datatest/sample" start\_position =\> "beginning" codec =\> multiline { pattern =\> "^%{TIMESTAMP\_ISO8601}" what =\> "previous" } } } filter… --- ## [Logstash 7.2 file input plugin network path wildcard didn't produce any out](https://discuss.elastic.co/t/logstash-7-2-file-input-plugin-network-path-wildcard-didnt-produce-any-out/188100)
**Author:** [@Alexl](https://discuss.elastic.co/u/Alexl)\ **Replies:** 1\ **Last updated:** [June 29, 2019, 7:05am UTC](https://discuss.elastic.co/t/logstash-7-2-file-input-plugin-network-path-wildcard-didnt-produce-any-out/188100 "2019-06-29T07:05:27Z")
Hi guys! Please, help. I have a remote file storage with thousands having 10mb average size text files. I'm using this code: input { file { path =\> "//foldername/\*\*/\*.dat" start\_position =\> "beginning" } } outpu… --- ## [Logstash Custom file for apache configuration](https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900)
**Author:** [@Aryan90](https://discuss.elastic.co/u/Aryan90)\ **Replies:** 2\ **Last updated:** [June 29, 2019, 6:26am UTC](https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900 "2019-06-29T06:26:37Z")
Hi Guys, I have installed ELK stack on single server and i have created a logstash file for apache server which is running on client server. I have setup the filebeat to read access and error log of apache. the problem… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=517) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=519)