# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=521 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 522 --- ## [OR condition in Logstash is not working](https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406)
**Author:** [@Arpit\_Gulati](https://discuss.elastic.co/u/Arpit_Gulati)\ **Replies:** 2\ **Last updated:** [June 19, 2019, 1:09pm UTC](https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406 "2019-06-19T13:09:28Z")
Hi, I need to drop some events in logtstash and for this I write a if condition if ( \[externalId\] != "4663" and "4662" not in \[externalId\] and "4728" not │le Management … --- ## [Logstash filter kv fortinet not searchable into kibana](https://discuss.elastic.co/t/logstash-filter-kv-fortinet-not-searchable-into-kibana/187367)
**Author:** [@temuccio](https://discuss.elastic.co/u/temuccio)\ **Replies:** 3\ **Last updated:** [June 26, 2019, 4:08am UTC](https://discuss.elastic.co/t/logstash-filter-kv-fortinet-not-searchable-into-kibana/187367 "2019-06-26T04:08:57Z")
Hello all, I have try to run stack ELK for fortinet's syslog. It's works and on kibana I see the log, but almost all fields are not searchable and they have a :question: before the name... :thinking: I have used on lo… --- ## [Logstash 7.1.1 - Production environment security and stability settings](https://discuss.elastic.co/t/logstash-7-1-1-production-environment-security-and-stability-settings/186756)
**Author:** [@Alexl](https://discuss.elastic.co/u/Alexl)\ **Replies:** 4\ **Last updated:** [June 26, 2019, 2:19am UTC](https://discuss.elastic.co/t/logstash-7-1-1-production-environment-security-and-stability-settings/186756 "2019-06-26T02:19:30Z")
Hello all! What settings do you recommend to consider before Logstash production deploy in ELK? Thank you for your assistance. --- ## [Logstash + Elasticsearch Boolean data 질문입니다](https://discuss.elastic.co/t/logstash-elasticsearch-boolean-data/187064)
**Author:** [@pgw5540](https://discuss.elastic.co/u/pgw5540)\ **Replies:** 6\ **Last updated:** [June 26, 2019, 2:19am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-boolean-data/187064 "2019-06-26T02:19:22Z")
Logstash로 csv 데이터를 입력하는 과정에서, 1,0 으로 들어오는 데이터를 boolean으로 Convert하여 입력할 때 에러가 발생합니다. Failed to convert \[Field name\] into boolean 해당 에러가 왜 발생하는지 알 수 있을까요? --- ## [Converting very old logstash setup to a moden version, syntax issue pulling info from filebeat](https://discuss.elastic.co/t/converting-very-old-logstash-setup-to-a-moden-version-syntax-issue-pulling-info-from-filebeat/186851)
**Author:** [@Rykon8472](https://discuss.elastic.co/u/Rykon8472)\ **Replies:** 6\ **Last updated:** [June 26, 2019, 1:35am UTC](https://discuss.elastic.co/t/converting-very-old-logstash-setup-to-a-moden-version-syntax-issue-pulling-info-from-filebeat/186851 "2019-06-26T01:35:08Z")
Hello All I'm fairly new at Logstash and I was tasked of taking our old beast of a Logstash server into the new age. We use our Filebeat/Logstash setup for a central logging server and nothing more. I've got 90% of th… --- ## [Wrong log combinations](https://discuss.elastic.co/t/wrong-log-combinations/186906)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 8\ **Last updated:** [June 25, 2019, 11:04pm UTC](https://discuss.elastic.co/t/wrong-log-combinations/186906 "2019-06-25T23:04:00Z")
Initially, I wrote a Logstash configuration file to pull Balena information in JSON data and then parse it with Logstash ruby filter plugin which made the data look like this: { "@version" =\> "1", "values"… --- ## [Generating events from JSON array inside root-level object](https://discuss.elastic.co/t/generating-events-from-json-array-inside-root-level-object/187386)
**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\ **Replies:** 5\ **Last updated:** [June 25, 2019, 10:10pm UTC](https://discuss.elastic.co/t/generating-events-from-json-array-inside-root-level-object/187386 "2019-06-25T22:10:40Z")
I'm trying to import data from a JSON file. The root level item in the file is an object containing two keys. One of those keys, datapoints, contains an array of objects that I would like to use as events. I cannot fin… --- ## [Mongodb Logstash Elasticsearch](https://discuss.elastic.co/t/mongodb-logstash-elasticsearch/187429)
**Author:** [@kv3singh](https://discuss.elastic.co/u/kv3singh)\ **Replies:** 0\ **Last updated:** [June 25, 2019, 8:39pm UTC](https://discuss.elastic.co/t/mongodb-logstash-elasticsearch/187429 "2019-06-25T20:39:29Z")
Hi, I am fetching data from mongodb as Input using Logstash and elasticsearch as output. Can anyone help me in getting data from two different collections of mongodb using logstash into two different index of elasticse… --- ## [File input plugin always leaving files behind](https://discuss.elastic.co/t/file-input-plugin-always-leaving-files-behind/187196)
**Author:** [@abcarroll](https://discuss.elastic.co/u/abcarroll)\ **Replies:** 8\ **Last updated:** [June 25, 2019, 7:22pm UTC](https://discuss.elastic.co/t/file-input-plugin-always-leaving-files-behind/187196 "2019-06-25T19:22:19Z")
Hello there. Frankly, I've given up on the S3 input plugin entirely. We are attempting to ingest ELB access logs via S3. They're always a little behind anyway in AWS - by about 5 minutes - so it's not possible to keep… --- ## [Configure logstash 1.4.2 for raspberry pi to get file from remote machine](https://discuss.elastic.co/t/configure-logstash-1-4-2-for-raspberry-pi-to-get-file-from-remote-machine/187397)
**Author:** [@gmahule](https://discuss.elastic.co/u/gmahule)\ **Replies:** 5\ **Last updated:** [June 25, 2019, 6:36pm UTC](https://discuss.elastic.co/t/configure-logstash-1-4-2-for-raspberry-pi-to-get-file-from-remote-machine/187397 "2019-06-25T18:36:15Z")
Hello, I am trying to configure logstash 1.4.2 in my raspberry pi to get file which is located in remote windows machine and in my logstash.conf I have changed the input path to the remote machine location and also shar… --- ## [Logstash reading the file line multiple times](https://discuss.elastic.co/t/logstash-reading-the-file-line-multiple-times/185201)
**Author:** [@Tania\_Saez](https://discuss.elastic.co/u/Tania_Saez)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 6:34pm UTC](https://discuss.elastic.co/t/logstash-reading-the-file-line-multiple-times/185201 "2019-06-25T18:34:57Z")
Hello, In my logstash installation, it is reading a csv file to insert it in elasticsearch. It should read each line just one time, but in fact is reading/processing up to 4 times: { "@version" =\> "1", "endpoint" =\> … --- ## [How to load/sync data from multiple mysql databases into elasticsearch server?](https://discuss.elastic.co/t/how-to-load-sync-data-from-multiple-mysql-databases-into-elasticsearch-server/186383)
**Author:** [@ronywsit](https://discuss.elastic.co/u/ronywsit)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 6:31pm UTC](https://discuss.elastic.co/t/how-to-load-sync-data-from-multiple-mysql-databases-into-elasticsearch-server/186383 "2019-06-25T18:31:07Z")
Hi there, I', new to elasticsearch platform. I've several stores (each store contain a mysql database). I want to give my user's (product) search feature from all my stores in a single place using elasticsearch (in anot… --- ## [Logstash (v6.8.1) permission denied when importing csv file](https://discuss.elastic.co/t/logstash-v6-8-1-permission-denied-when-importing-csv-file/187027)
**Author:** [@Scorpion21](https://discuss.elastic.co/u/Scorpion21)\ **Replies:** 2\ **Last updated:** [June 25, 2019, 6:31pm UTC](https://discuss.elastic.co/t/logstash-v6-8-1-permission-denied-when-importing-csv-file/187027 "2019-06-25T18:31:02Z")
I am a new starter to run Elastic Stac 6.8.1 on mac pro. These errors keeping on pop up, when I try to import csv file to elasticsearch via logstash. Does anyone know that is the root cause and how to fix that up? Tha… --- ## [Multiple log lines in one](https://discuss.elastic.co/t/multiple-log-lines-in-one/186686)
**Author:** [@veselid](https://discuss.elastic.co/u/veselid)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 6:26pm UTC](https://discuss.elastic.co/t/multiple-log-lines-in-one/186686 "2019-06-25T18:26:26Z")
Dear all, First, i am completely new in ELK Stack, and i need your help, some hints... In my pipeline conf file, i have configured grok filter to use "COMBINEDAPACHELOG" pattern, and in Kibana i can see "message" struc… --- ## [Manage events Logstash](https://discuss.elastic.co/t/manage-events-logstash/186806)
**Author:** [@xavi23](https://discuss.elastic.co/u/xavi23)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 6:24pm UTC](https://discuss.elastic.co/t/manage-events-logstash/186806 "2019-06-25T18:24:57Z")
Hi, Actually I'm using logstash to index/update some documents in ElasticSearch. I want know how I can manage the events that logstash recive of my inputs. For example if I need index 1000 documents , I want know in e… --- ## [Using logstash to collect all the data transiting in the internet router](https://discuss.elastic.co/t/using-logstash-to-collect-all-the-data-transiting-in-the-internet-router/186953)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 6:22pm UTC](https://discuss.elastic.co/t/using-logstash-to-collect-all-the-data-transiting-in-the-internet-router/186953 "2019-06-25T18:22:45Z")
is it possible to intercept all the data passing through my intrent router (visited web site, data exchanged, email ...), is there any configuration --- ## [¿logstash puede leer archivos desde otro servidor?](https://discuss.elastic.co/t/logstash-puede-leer-archivos-desde-otro-servidor/187408)
**Author:** [@feevv](https://discuss.elastic.co/u/feevv)\ **Replies:** 0\ **Last updated:** [June 25, 2019, 6:22pm UTC](https://discuss.elastic.co/t/logstash-puede-leer-archivos-desde-otro-servidor/187408 "2019-06-25T18:22:38Z")
Buenas tardes, Alguien me puede indicar si Logstash puede leer archivos de logs que se encuentran en una ubicacion especifica de otro servidor en la red, sin que sean enviados directamente al servidor donde está instala… --- ## [Logstash 7.0.1 output to CSV empty](https://discuss.elastic.co/t/logstash-7-0-1-output-to-csv-empty/187377)
**Author:** [@etsai7](https://discuss.elastic.co/u/etsai7)\ **Replies:** 0\ **Last updated:** [June 25, 2019, 3:53pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-output-to-csv-empty/187377 "2019-06-25T15:53:27Z")
Edit: Never mind, I was able to figure it out. The issue was stemming from a wrong location output. Hello, I am trying to output Netflow data out to a csv using Logstash 7.0.1. For testing purposes, I am only including… --- ## [Elastic 7.0 and Netflow module : no more indices created since upgrade to 7.0](https://discuss.elastic.co/t/elastic-7-0-and-netflow-module-no-more-indices-created-since-upgrade-to-7-0/180424)
**Author:** [@samia](https://discuss.elastic.co/u/samia)\ **Replies:** 4\ **Last updated:** [June 25, 2019, 5:13pm UTC](https://discuss.elastic.co/t/elastic-7-0-and-netflow-module-no-more-indices-created-since-upgrade-to-7-0/180424 "2019-06-25T17:13:36Z")
Hi, I had elastic stack 5.6.4 running and netflow module used with logstash. Every thing was working normally. I just upgraded to 7.0 and saw that the Netflow module couldn't work any more : No more new netflow\* indic… --- ## [ILM policy not attached when index is deleted while Logstash is running](https://discuss.elastic.co/t/ilm-policy-not-attached-when-index-is-deleted-while-logstash-is-running/187185)
**Author:** [@dennis.rietvink](https://discuss.elastic.co/u/dennis.rietvink)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 6:52pm UTC](https://discuss.elastic.co/t/ilm-policy-not-attached-when-index-is-deleted-while-logstash-is-running/187185 "2019-06-24T18:52:54Z")
Hi, I use logstash to handle ILM configuration on my indexes. This works well on startup of Logstash when no index exists. An index is created using the rollover\_alias with the default ilm pattern and the policy gets a… --- ## [S3 Output Plugin with many S3 buckets takes 30 minutes to start](https://discuss.elastic.co/t/s3-output-plugin-with-many-s3-buckets-takes-30-minutes-to-start/184685)
**Author:** [@dorth](https://discuss.elastic.co/u/dorth)\ **Replies:** 4\ **Last updated:** [June 25, 2019, 4:07pm UTC](https://discuss.elastic.co/t/s3-output-plugin-with-many-s3-buckets-takes-30-minutes-to-start/184685 "2019-06-25T16:07:56Z")
I'm using Logstash 7.1.1 and logstash-output-s3 4.1.9. I have 38 different output locations (S3 buckets) depending on the logic. Logstash is taking nearly 30 minutes to start. \[2019-06-07T01:21:21,711\]\[INFO \]\[logstash… --- ## [We need to forward a field to remote destination](https://discuss.elastic.co/t/we-need-to-forward-a-field-to-remote-destination/187267)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 2:37pm UTC](https://discuss.elastic.co/t/we-need-to-forward-a-field-to-remote-destination/187267 "2019-06-25T14:37:05Z")
Hi, We have the following architecture: x2 logstash x2 Elasticsearch Logstash is receiving logs and sending them to Elasticsearch. If i view the logs in Kibana we have a field called "full\_log" which is containing al… --- ## [Regroup fields logstash](https://discuss.elastic.co/t/regroup-fields-logstash/187333)
**Author:** [@Mouloud\_CHIKHOUNE](https://discuss.elastic.co/u/Mouloud_CHIKHOUNE)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 2:28pm UTC](https://discuss.elastic.co/t/regroup-fields-logstash/187333 "2019-06-25T14:28:07Z")
Hi, I have a log file structured like this : 2019-06-20T05:39:27,568 | INFO | INPUT| UID1 2019-06-20T05:39:28,874 | INFO | INPUT| UID2 2019-06-20T05:39:28,879 | INFO | OUTPUT | UID1 2019-06-20T05:39:28,88… --- ## [Grok filter on massive log](https://discuss.elastic.co/t/grok-filter-on-massive-log/187254)
**Author:** [@manosmustang](https://discuss.elastic.co/u/manosmustang)\ **Replies:** 3\ **Last updated:** [June 25, 2019, 2:18pm UTC](https://discuss.elastic.co/t/grok-filter-on-massive-log/187254 "2019-06-25T14:18:15Z")
Hello, Newbie at Grok and I want to ask the below I have a big log from weblogic such as: 2019-06-24 11:56:25,782 \[\[ACTIVE\] ExecuteThread: '333' for queue: 'weblogic.kernel.Default (self-tuning)'\] ERROR motive.utiliti… --- ## [Rename field value of int with string name](https://discuss.elastic.co/t/rename-field-value-of-int-with-string-name/186769)
**Author:** [@John\_Lim](https://discuss.elastic.co/u/John_Lim)\ **Replies:** 2\ **Last updated:** [June 25, 2019, 1:58pm UTC](https://discuss.elastic.co/t/rename-field-value-of-int-with-string-name/186769 "2019-06-25T13:58:21Z")
Hello all, Please provide some tips regarding grok mutate issue. 1.) I created a Kibana dashboard but it will make more sense if I can rename the field value. For instance the action type of Web Security Gateway logs s… --- ## [Grok capture index value with different patterns within the message](https://discuss.elastic.co/t/grok-capture-index-value-with-different-patterns-within-the-message/186770)
**Author:** [@John\_Lim](https://discuss.elastic.co/u/John_Lim)\ **Replies:** 2\ **Last updated:** [June 25, 2019, 1:57pm UTC](https://discuss.elastic.co/t/grok-capture-index-value-with-different-patterns-within-the-message/186770 "2019-06-25T13:57:16Z")
Thank you in advance, Please advise how can I capture logs that have different pattern, let say for username, the value shows \[ldap:my\_user01\], and I created grok to capture this by \\\[ldap0:%{USERNAME:username}\\\], the… --- ## [Logstash starts but doesn't do anything](https://discuss.elastic.co/t/logstash-starts-but-doesnt-do-anything/184381)
**Author:** [@LogstashRookie](https://discuss.elastic.co/u/LogstashRookie)\ **Replies:** 6\ **Last updated:** [June 25, 2019, 1:28pm UTC](https://discuss.elastic.co/t/logstash-starts-but-doesnt-do-anything/184381 "2019-06-25T13:28:57Z")
Hi , im new too ELK . Im trying to get some data in my logstash but my service doesn't seem to work properly. Im running on an ubuntu 14 vm. When i check my logstash status i get the following: logstash.service - logs… --- ## [Group the fields](https://discuss.elastic.co/t/group-the-fields/187115)
**Author:** [@Mouloud\_CHIKHOUNE](https://discuss.elastic.co/u/Mouloud_CHIKHOUNE)\ **Replies:** 2\ **Last updated:** [June 25, 2019, 12:36pm UTC](https://discuss.elastic.co/t/group-the-fields/187115 "2019-06-25T12:36:13Z")
Hi, I have a log file structured like this : 2019-06-20T05:39:27,568 | INFO | qtp441473107-156663 | UID1 2019-06-20T05:39:28,874 | INFO | qtp441473107-156785 | UID1 2019-06-20T05:39:28,879 | INFO | qtp4414… --- ## [Need help on Grok Filter?](https://discuss.elastic.co/t/need-help-on-grok-filter/187227)
**Author:** [@shankarananth](https://discuss.elastic.co/u/shankarananth)\ **Replies:** 2\ **Last updated:** [June 25, 2019, 9:28am UTC](https://discuss.elastic.co/t/need-help-on-grok-filter/187227 "2019-06-25T09:28:25Z")
Hai All, I'm newbie to ELK. I need to write a grok command to separate below value. Have some challenges in achieving it. Value = uda:eop:de:solu:400003112342.E\_BADF\_COE\_009\_003.DI poc grok command =%{WORD:line1}:%{W… --- ## [Sample apache filter doesnt works 7.1.x](https://discuss.elastic.co/t/sample-apache-filter-doesnt-works-7-1-x/187160)
**Author:** [@gyurielf](https://discuss.elastic.co/u/gyurielf)\ **Replies:** 6\ **Last updated:** [June 25, 2019, 10:12am UTC](https://discuss.elastic.co/t/sample-apache-filter-doesnt-works-7-1-x/187160 "2019-06-25T10:12:04Z")
Hello Guyz! I need some help.. :frowning: I try to use ELK stack(lastest 7.1.x) for log centralization... but something wrong with the apache log filter conf example. In the dashboard, all data has appear but doesnt p… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=520) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=522)