# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=527 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 528 --- ## [Lostash - nagios\_nsca plugin - nagios\_status](https://discuss.elastic.co/t/lostash-nagios-nsca-plugin-nagios-status/179377)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 2\ **Last updated:** [June 17, 2019, 7:37am UTC](https://discuss.elastic.co/t/lostash-nagios-nsca-plugin-nagios-status/179377 "2019-06-17T07:37:58Z")
Hello, I am trying to send passive check to nagios using Logstash nagios\_nsca plugin. Elasticstack v 6.3.2 /usr/share/logstash/bin/logstash-plugin list | grep nsca logstash-output-nagios\_nsca Configuration: pipelin… --- ## [How to get .gz files using Gzip\_lines codec plugin from a pipeline?](https://discuss.elastic.co/t/how-to-get-gz-files-using-gzip-lines-codec-plugin-from-a-pipeline/185746)
**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Replies:** 7\ **Last updated:** [June 17, 2019, 2:22am UTC](https://discuss.elastic.co/t/how-to-get-gz-files-using-gzip-lines-codec-plugin-from-a-pipeline/185746 "2019-06-17T02:22:32Z")
How to get .gz files using Gzip\_lines codec plugin from a pipeline? input { pipeline { address =\> testgz #has been configured to send .gz files into this pipe codec =\> gzip\_lines } } output { st… --- ## [Problem with kv filter](https://discuss.elastic.co/t/problem-with-kv-filter/185644)
**Author:** [@GGUERRA](https://discuss.elastic.co/u/GGUERRA)\ **Replies:** 3\ **Last updated:** [June 17, 2019, 7:24am UTC](https://discuss.elastic.co/t/problem-with-kv-filter/185644 "2019-06-17T07:24:11Z")
Hello everyone, I have the following situation, I am reading the logs from a file and these come as follows: Jun 12 23:29:08 172.17.6.10 field1="value1" field2=value2 field3=value3 ... etc My input, filter and output … --- ## [When multiple pipeline is configured for logstash which is running on docker, data transfer is not happened](https://discuss.elastic.co/t/when-multiple-pipeline-is-configured-for-logstash-which-is-running-on-docker-data-transfer-is-not-happened/185994)
**Author:** [@garima](https://discuss.elastic.co/u/garima)\ **Replies:** 0\ **Last updated:** [June 17, 2019, 5:50am UTC](https://discuss.elastic.co/t/when-multiple-pipeline-is-configured-for-logstash-which-is-running-on-docker-data-transfer-is-not-happened/185994 "2019-06-17T05:50:36Z")
When multiple pipeline is configured for logstash running on docker with custom image then logstash pipeline gets started successfully, data transfer is not happened. Execution Steps: 1. Add below parameters in pip… --- ## [Logstash not working after changing password](https://discuss.elastic.co/t/logstash-not-working-after-changing-password/185788)
**Author:** [@turnip](https://discuss.elastic.co/u/turnip)\ **Replies:** 3\ **Last updated:** [June 17, 2019, 2:27am UTC](https://discuss.elastic.co/t/logstash-not-working-after-changing-password/185788 "2019-06-17T02:27:08Z")
Hi all i have recently started on elk stack, and i have encounter some problem after changing the default password. Current stack version 7.0.1 based off this link https://github.com/deviantony/docker-elk after settin… --- ## [Logstash can not write date into elasticsearch after activating elastic security](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340)
**Author:** [@PolterFox](https://discuss.elastic.co/u/PolterFox)\ **Replies:** 11\ **Last updated:** [June 17, 2019, 1:04am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340 "2019-06-17T01:04:57Z")
Hey guys, I´ve a problem with logstash. After activating the stack security, logstash can not write into elasticsearch. I´ve followed the instructions in the install guide and created a logstash\_internal user which ha… --- ## [Logstash showing logs send to Kibana with yellow index and mismatched pre-populated fields mapping](https://discuss.elastic.co/t/logstash-showing-logs-send-to-kibana-with-yellow-index-and-mismatched-pre-populated-fields-mapping/185975)
**Author:** [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Replies:** 0\ **Last updated:** [June 16, 2019, 8:39pm UTC](https://discuss.elastic.co/t/logstash-showing-logs-send-to-kibana-with-yellow-index-and-mismatched-pre-populated-fields-mapping/185975 "2019-06-16T20:39:35Z")
Using the following version for:- logstash 7.1.1 Kibana "7.1.1 elasticsearch: 7.1.1 \*\*My \*\* logstash.conf input { beats { port =\> 5044} } filter { grok { match =\> \[ "message", "%{TIMESTAMP\_ISO8601:ti… --- ## [Is it possible to select which event to be processed by each worker?](https://discuss.elastic.co/t/is-it-possible-to-select-which-event-to-be-processed-by-each-worker/182096)
**Author:** [@jcaballero](https://discuss.elastic.co/u/jcaballero)\ **Replies:** 15\ **Last updated:** [June 16, 2019, 6:48pm UTC](https://discuss.elastic.co/t/is-it-possible-to-select-which-event-to-be-processed-by-each-worker/182096 "2019-06-16T18:48:23Z")
Hi, Logstash 6.7.1 As my workflows are a little bit complicate, since I need to parse together different lines (events) lines are non consecutive lines do not have any common label or tag I implemented the filtering… --- ## [Lookup Values](https://discuss.elastic.co/t/lookup-values/184552)
**Author:** [@Yoav\_Ben\_Moha](https://discuss.elastic.co/u/Yoav_Ben_Moha)\ **Replies:** 2\ **Last updated:** [June 15, 2019, 5:15pm UTC](https://discuss.elastic.co/t/lookup-values/184552 "2019-06-15T17:15:21Z")
I have CDR file contain 100K rows. Some of the columns in that CDR file contain ID columns. I need to do a lookup and fetch the description of those ID columns. For columns that has small set of ID\`s descriptions , i … --- ## [Logstash durability and scalibility](https://discuss.elastic.co/t/logstash-durability-and-scalibility/185929)
**Author:** [@Shubham\_Yadav1](https://discuss.elastic.co/u/Shubham_Yadav1)\ **Replies:** 1\ **Last updated:** [June 15, 2019, 8:53am UTC](https://discuss.elastic.co/t/logstash-durability-and-scalibility/185929 "2019-06-15T08:53:04Z")
Hello folks! Please help with these quesitons. I am running a load test which is generating 8-10 gb of real time logs in an hour, what settings will be the best to make sure that no data is lost? What's the diff bw "s… --- ## [Updating elasticsearch document, without adding "doc"](https://discuss.elastic.co/t/updating-elasticsearch-document-without-adding-doc/185880)
**Author:** [@T1mmy](https://discuss.elastic.co/u/T1mmy)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 11:47pm UTC](https://discuss.elastic.co/t/updating-elasticsearch-document-without-adding-doc/185880 "2019-06-14T23:47:48Z")
I'm trying to update my users in elasticsearch via logstash couchdb\_changes. But everytime a change is made to the user, logstatsh adds a "doc"-subarray with the new changes to my document in elasticsearch, instead of up… --- ## [Logrotation with Logstash](https://discuss.elastic.co/t/logrotation-with-logstash/185916)
**Author:** [@Kanwar\_Malik](https://discuss.elastic.co/u/Kanwar_Malik)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 10:34pm UTC](https://discuss.elastic.co/t/logrotation-with-logstash/185916 "2019-06-14T22:34:56Z")
SETUP: I have a kubernetes cluster with 5 nodes, each node has a logstash (replica:1) that is collecting logs from all the pods (via filebeat) on the node, and is writing files on a mounted volume (500 G). I have setup a… --- ## [Logstash is periodically hanging (unresponsive). How to recognize and fix?](https://discuss.elastic.co/t/logstash-is-periodically-hanging-unresponsive-how-to-recognize-and-fix/183794)
**Author:** [@PaulDonskikh](https://discuss.elastic.co/u/PaulDonskikh)\ **Replies:** 3\ **Last updated:** [June 14, 2019, 9:56pm UTC](https://discuss.elastic.co/t/logstash-is-periodically-hanging-unresponsive-how-to-recognize-and-fix/183794 "2019-06-14T21:56:04Z")
Hi! I'm working on an ELK-stack installation. And there's a logstash instance which for some unknown yet reason periodically (once in 2-10 days) stops inserting data into ES. And the most confusing part is that the lo… --- ## [Can I run logstash plugins in sandbox](https://discuss.elastic.co/t/can-i-run-logstash-plugins-in-sandbox/185806)
**Author:** [@tacyeh](https://discuss.elastic.co/u/tacyeh)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 6:04pm UTC](https://discuss.elastic.co/t/can-i-run-logstash-plugins-in-sandbox/185806 "2019-06-14T18:04:14Z")
some case, I want run ruby code in logstash or exec command, but it can modify and read any thing in host, if I expose some api for user modify logstash filters, it maybe not safity. so is there a way to run it in sandbo… --- ## [How to track failure or exception?](https://discuss.elastic.co/t/how-to-track-failure-or-exception/185893)
**Author:** [@nobound](https://discuss.elastic.co/u/nobound)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 6:02pm UTC](https://discuss.elastic.co/t/how-to-track-failure-or-exception/185893 "2019-06-14T18:02:51Z")
Hi, In the logstash configuration file, I use grok, ruby and aggregate multiple times within the filter section. When I check for \_grokparsefailure, \_aggregateexception, \_rubyexception (whatever do I need to check?) at … --- ## [Logstash 7.0.1 Exception in pipelineworker](https://discuss.elastic.co/t/logstash-7-0-1-exception-in-pipelineworker/182760)
**Author:** [@nobound](https://discuss.elastic.co/u/nobound)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 6:00pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-exception-in-pipelineworker/182760 "2019-06-14T18:00:04Z")
I am getting the following exceptions constantly. \[2019-05-25T12:37:07,301\]\[ERROR\]\[org.logstash.execution.WorkerLoop\] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter con… --- ## [Logstash giving nfs stale error](https://discuss.elastic.co/t/logstash-giving-nfs-stale-error/185891)
**Author:** [@Amit\_Singh3](https://discuss.elastic.co/u/Amit_Singh3)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 4:27pm UTC](https://discuss.elastic.co/t/logstash-giving-nfs-stale-error/185891 "2019-06-14T16:27:54Z")
I have few server logs folder mounted on Solaris server with NFS protocol, and we run logstash command on screen, but after a while it gives error nfs Error: unknown IOException: jnr.enxio.channels.NativeException:… --- ## [Logstash kafka output plugin not behaving according to documentation](https://discuss.elastic.co/t/logstash-kafka-output-plugin-not-behaving-according-to-documentation/185280)
**Author:** [@preddy75](https://discuss.elastic.co/u/preddy75)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 3:49pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-plugin-not-behaving-according-to-documentation/185280 "2019-06-14T15:49:09Z")
I cannot get logstash-kafka output plugin to work with basic auth. I am using below, but it will not let me do it because it insists on on a keyfile to be specified: logstash output config: output { if "kafka" in … --- ## [Neflow Issues with logstash](https://discuss.elastic.co/t/neflow-issues-with-logstash/185874)
**Author:** [@schap](https://discuss.elastic.co/u/schap)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 2:11pm UTC](https://discuss.elastic.co/t/neflow-issues-with-logstash/185874 "2019-06-14T14:11:09Z")
Hello I keep getting connetion refused errors when i try running : ./bin/logstash --modules netflow --setup // \[WARN \] 2019-06-14 10:06:20.912 \[LogStash::Runner\] multilocal - Ignoring the 'pipelines.yml' file because mo… --- ## [Solution access to one source](https://discuss.elastic.co/t/solution-access-to-one-source/185873)
**Author:** [@gcolmant](https://discuss.elastic.co/u/gcolmant)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 2:09pm UTC](https://discuss.elastic.co/t/solution-access-to-one-source/185873 "2019-06-14T14:09:23Z")
Hello , i need a solution to monitoring many PBX and other systems and i want to know if Elastic / Logstash / Kibana can do something about right so i have many users and many systems to administrate. So i have one u… --- ## [Insert complex nested json documents from Postgres to Elasticsearch via Logstash](https://discuss.elastic.co/t/insert-complex-nested-json-documents-from-postgres-to-elasticsearch-via-logstash/185813)
**Author:** [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\ **Replies:** 4\ **Last updated:** [June 14, 2019, 1:59pm UTC](https://discuss.elastic.co/t/insert-complex-nested-json-documents-from-postgres-to-elasticsearch-via-logstash/185813 "2019-06-14T13:59:07Z")
Hi, I have seen in other topics and I have also verified in first person that Logstash does not recognize json object from the jdbc input and an error related to the PGobject comes out, like this: Exception when execut… --- ## [How to find logstash line number if we have multiple configuration files](https://discuss.elastic.co/t/how-to-find-logstash-line-number-if-we-have-multiple-configuration-files/185791)
**Author:** [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Replies:** 2\ **Last updated:** [June 14, 2019, 1:34pm UTC](https://discuss.elastic.co/t/how-to-find-logstash-line-number-if-we-have-multiple-configuration-files/185791 "2019-06-14T13:34:23Z")
Hi, We have multiple configuration files in /etc/logstash/conf.d .How to find the line number as it is throwing following error at some line number? Failed to execute action {:action=\>LogStash::PipelineAction::Create/p… --- ## [\[ElasticSearch Output Plugin\] Dynamic User for authentication](https://discuss.elastic.co/t/elasticsearch-output-plugin-dynamic-user-for-authentication/185811)
**Author:** [@salkonuhannovic](https://discuss.elastic.co/u/salkonuhannovic)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 1:25pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-dynamic-user-for-authentication/185811 "2019-06-14T13:25:06Z")
Hi, is it possible to set the user in the ElasticSearch output plugin dynamically? Im trying to retrieve the User Information out of the HTTP Headers which are passed. For the Index its working properly but the User is… --- ## [Logstash log forwading from AIX will work.?](https://discuss.elastic.co/t/logstash-log-forwading-from-aix-will-work/185844)
**Author:** [@Dinesh-AI](https://discuss.elastic.co/u/Dinesh-AI)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 11:39am UTC](https://discuss.elastic.co/t/logstash-log-forwading-from-aix-will-work/185844 "2019-06-14T11:39:11Z")
Hi Team, We are trying to forward application logs from an AIX server. We have configured the rsyslog to forward the system logs, which is working fine. And also we have configured rsyslog to forward the application l… --- ## [Logstash syslog output format](https://discuss.elastic.co/t/logstash-syslog-output-format/185834)
**Author:** [@vld53](https://discuss.elastic.co/u/vld53)\ **Replies:** 5\ **Last updated:** [June 14, 2019, 11:36am UTC](https://discuss.elastic.co/t/logstash-syslog-output-format/185834 "2019-06-14T11:36:23Z")
Hello guys! I have question about syslog output plugin. Configuration: output { if "mail" in \[tags\] { syslog { facility =\> "local0" host =\> "192.168.0.3… --- ## [Index name with http input and es\_bulk codec \[Second try\]](https://discuss.elastic.co/t/index-name-with-http-input-and-es-bulk-codec-second-try/185825)
**Author:** [@yannis\_despotopoulos](https://discuss.elastic.co/u/yannis_despotopoulos)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 10:10am UTC](https://discuss.elastic.co/t/index-name-with-http-input-and-es-bulk-codec-second-try/185825 "2019-06-14T10:10:01Z")
Hello, I am facing exactly the same issue as in hte following (not anwered) topic: Index name with http input and es\_bulk codec using logstash 6.5.2. Is there a way to get the index submitted from es\_bulk codec? than… --- ## [0365 Unified Log](https://discuss.elastic.co/t/0365-unified-log/185828)
**Author:** [@a899090](https://discuss.elastic.co/u/a899090)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 9:55am UTC](https://discuss.elastic.co/t/0365-unified-log/185828 "2019-06-14T09:55:13Z")
So 0365 allows you to export Unifed Audit log in CSV format via frontend or using powershell. Does anyone have a working method of parsing one or multiple CSV in a local directory and pushing it through to ELK? --- ## [Akamai logs to logstash](https://discuss.elastic.co/t/akamai-logs-to-logstash/185595)
**Author:** [@dheeraj\_kumar](https://discuss.elastic.co/u/dheeraj_kumar)\ **Replies:** 1\ **Last updated:** [June 14, 2019, 9:05am UTC](https://discuss.elastic.co/t/akamai-logs-to-logstash/185595 "2019-06-14T09:05:50Z")
Hi, Could anyone help me with the basic logstash config to parse Akamai logs to Elasticsearch. Any help would be much appreciated, i have log files on FTP which i can download locally, looking for approach to handle th… --- ## [Docker Connection refused with elasticsearch](https://discuss.elastic.co/t/docker-connection-refused-with-elasticsearch/185812)
**Author:** [@crobix](https://discuss.elastic.co/u/crobix)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 9:02am UTC](https://discuss.elastic.co/t/docker-connection-refused-with-elasticsearch/185812 "2019-06-14T09:02:56Z")
Hello, I got an issue while i try to connect logstash with elasticsearch and i can't solve it \[2019-06-14T08:49:25,833\]\[WARN \]\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance, but… --- ## [How to define the host field going forward](https://discuss.elastic.co/t/how-to-define-the-host-field-going-forward/185804)
**Author:** [@fhlmbrg](https://discuss.elastic.co/u/fhlmbrg)\ **Replies:** 0\ **Last updated:** [June 14, 2019, 8:43am UTC](https://discuss.elastic.co/t/how-to-define-the-host-field-going-forward/185804 "2019-06-14T08:43:31Z")
Hi, Ref. the ECS schema definition of the host field https://github.com/elastic/ecs/blob/master/schemas/host.yml When running av mix of Beats and Syslog/UDP inputs to Logstash, the host field gets defined differently. … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=526) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=528)