# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=538 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 539 --- ## [Logstash Issue : Failed to execute action](https://discuss.elastic.co/t/logstash-issue-failed-to-execute-action/183439)
**Author:** [@Bhargav\_Ram\_Reddy](https://discuss.elastic.co/u/Bhargav_Ram_Reddy)\ **Replies:** 1\ **Last updated:** [May 30, 2019, 9:53am UTC](https://discuss.elastic.co/t/logstash-issue-failed-to-execute-action/183439 "2019-05-30T09:53:41Z")
Hello, i have installed elasticsearch, created template (server-logs) and started the service on 9200 Also, added below code in logstash config file but when i try to start logstash service it is throwing an error inp… --- ## [Logstash-6.7.0 failing to Start on java 1.8.0\_201](https://discuss.elastic.co/t/logstash-6-7-0-failing-to-start-on-java-1-8-0-201/182549)
**Author:** [@nagarjun1](https://discuss.elastic.co/u/nagarjun1)\ **Replies:** 2\ **Last updated:** [May 30, 2019, 9:37am UTC](https://discuss.elastic.co/t/logstash-6-7-0-failing-to-start-on-java-1-8-0-201/182549 "2019-05-30T09:37:41Z")
Dear Team, The plain logstash installation on Windows failing to run with the below errors, any help on why this happens is appreciated : Blockquote \[2019-05-24T11:42:46,233\]\[ERROR\]\[logstash.agent \] Faile… --- ## [18 digit timestamp to ISO timings](https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225)
**Author:** [@Abinaya](https://discuss.elastic.co/u/Abinaya)\ **Replies:** 2\ **Last updated:** [May 30, 2019, 9:35am UTC](https://discuss.elastic.co/t/18-digit-timestamp-to-iso-timings/183225 "2019-05-30T09:35:31Z")
Hi Team, I have a 18 digit timestamp from a .NET error logs. I need to convert it to a readable date time format. The parameter "DateTime" need to be changed to readable format using logstash Sample log: MESSAGE Logg… --- ## [Unable to use TAB as a delimiter](https://discuss.elastic.co/t/unable-to-use-tab-as-a-delimiter/183496)
**Author:** [@abramley](https://discuss.elastic.co/u/abramley)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 9:16am UTC](https://discuss.elastic.co/t/unable-to-use-tab-as-a-delimiter/183496 "2019-05-30T09:16:46Z")
I'm trying to use CSV (but have also tried DISSECT) to bring data into elastic from a TAB delimitered file , the problem is I just can't get it to recognise a TAB. I'm using a centrally managed pipeline so entering the c… --- ## [Unable to load data from Oracle DB](https://discuss.elastic.co/t/unable-to-load-data-from-oracle-db/183465)
**Author:** [@ashokchinna](https://discuss.elastic.co/u/ashokchinna)\ **Replies:** 3\ **Last updated:** [May 30, 2019, 7:53am UTC](https://discuss.elastic.co/t/unable-to-load-data-from-oracle-db/183465 "2019-05-30T07:53:31Z")
Command ./logstash -f ../conf/jdbc.conf File #jdbc.conf input { jdbc { # path of the jdbc driver jdbc\_driver\_library =\> "C:\\Ashok\\ojdbc8-full\\ojdbc8.jar" # The name of the driv… --- ## [ERROR: Installation Aborted](https://discuss.elastic.co/t/error-installation-aborted/183476)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [May 30, 2019, 7:31am UTC](https://discuss.elastic.co/t/error-installation-aborted/183476 "2019-05-30T07:31:50Z")
Hey I'm running Logstash 6.5.3 I want to install plugin but I am getting error. bin/logstash-plugin install logstash-output-elasticsearch-license Validating logstash-output-elasticsearch-license Installing lo… --- ## [Logstash missing files](https://discuss.elastic.co/t/logstash-missing-files/183352)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 2\ **Last updated:** [May 30, 2019, 6:58am UTC](https://discuss.elastic.co/t/logstash-missing-files/183352 "2019-05-30T06:58:00Z")
Hi See my logstash input config - #input { file { path =\> "/data/logs/\*" mode =\> "read" file\_completed\_action =\> "log" file\_completed\_log\_path =\> "/data/logstash-db/17\_file\_completed\_log" } } I placed 4389 file… --- ## [Re-index SQL modified data through logstash](https://discuss.elastic.co/t/re-index-sql-modified-data-through-logstash/183470)
**Author:** [@Soumyapriya\_Sahoo](https://discuss.elastic.co/u/Soumyapriya_Sahoo)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 6:43am UTC](https://discuss.elastic.co/t/re-index-sql-modified-data-through-logstash/183470 "2019-05-30T06:43:22Z")
Hi, I am using logstash to ingest data into elastic search from a DB in SQL.How can i update index when a data is modified in SQL ? --- ## [Setup questions for custom logs from application into logstash](https://discuss.elastic.co/t/setup-questions-for-custom-logs-from-application-into-logstash/183466)
**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Replies:** 3\ **Last updated:** [May 30, 2019, 6:32am UTC](https://discuss.elastic.co/t/setup-questions-for-custom-logs-from-application-into-logstash/183466 "2019-05-30T06:32:14Z")
Hello, I am very new to ELK stack and have successfully setup one. Currently, i am learning how to parse custom application logs into Logstash pipeline then to elasticsearch and hope to see these data on kibana. Hence … --- ## [Unable to connect webhook with logstash](https://discuss.elastic.co/t/unable-to-connect-webhook-with-logstash/183454)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 4:08am UTC](https://discuss.elastic.co/t/unable-to-connect-webhook-with-logstash/183454 "2019-05-30T04:08:11Z")
Hey I want to create alert using webhook. So, kindly help me with that. And i want to connect logstash with webhook but facing some problem. While running this config file, I am not able to receive anything. input {… --- ## [Create grok for two different kind of logs](https://discuss.elastic.co/t/create-grok-for-two-different-kind-of-logs/180282)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 8\ **Last updated:** [May 13, 2019, 7:58am UTC](https://discuss.elastic.co/t/create-grok-for-two-different-kind-of-logs/180282 "2019-05-13T07:58:04Z")
Hello Can someone Please guide me how to create grok for two different kind of logs. A help would be highly appreciated. 2019/05/01 00:52:51.301 \< Success 2019/05/01 00:53:04.443 \> GET http://www.testenvironment.com/s… --- ## [Logstash takes more space than allocated for persistance queue](https://discuss.elastic.co/t/logstash-takes-more-space-than-allocated-for-persistance-queue/183460)
**Author:** [@nishan256](https://discuss.elastic.co/u/nishan256)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 4:48am UTC](https://discuss.elastic.co/t/logstash-takes-more-space-than-allocated-for-persistance-queue/183460 "2019-05-30T04:48:57Z")
My logstash configuration just takes inputs from filebeat and sends to a http server using http output pluging. To learn about behaviour of persistance queues, I just started filebeat and logstash but not http server. So… --- ## [Logstash with ES 6.2.2](https://discuss.elastic.co/t/logstash-with-es-6-2-2/183457)
**Author:** [@hirennarsana](https://discuss.elastic.co/u/hirennarsana)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 4:24am UTC](https://discuss.elastic.co/t/logstash-with-es-6-2-2/183457 "2019-05-30T04:24:38Z")
getting ORA-04036: PGA memory used by the instance exceeds PGA\_AGGREGATE\_LIMIT error while doing bulk processing with logstash JDBC input. Dont have control to set PGA\_AGGREGATE\_LIMIT. --- ## [Logstash with Azure Blob Storage Failed to open TCP connection](https://discuss.elastic.co/t/logstash-with-azure-blob-storage-failed-to-open-tcp-connection/183447)
**Author:** [@Fire\_fire](https://discuss.elastic.co/u/Fire_fire)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 2:33am UTC](https://discuss.elastic.co/t/logstash-with-azure-blob-storage-failed-to-open-tcp-connection/183447 "2019-05-30T02:33:46Z")
\[ERROR\]\[logstash.inputs.logstashinputazureblob\] Oh My, An error occurred. Failed to open TCP connection to xxxxxxx.blob.https:443 (initialize: name or service not known): \["org/jruby/ext/socket/RubyTCPSocket.java:137:in i… --- ## [All logs are gathered under \_grokparsefailure tags](https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274)
**Author:** [@cpatel](https://discuss.elastic.co/u/cpatel)\ **Replies:** 0\ **Last updated:** [May 2, 2019, 2:04am UTC](https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274 "2019-05-02T02:04:14Z")
I am using following logstash files to filter all juniper SRX related logs and most of logs are tagged under \_grokparsefailure tags. and they are stored in failed\_syslogs file. I am pretty new to ELK ,but i have used fi… --- ## [Access the request via Logstash - Map keys](https://discuss.elastic.co/t/access-the-request-via-logstash-map-keys/183441)
**Author:** [@Adam\_Grimes](https://discuss.elastic.co/u/Adam_Grimes)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 1:02am UTC](https://discuss.elastic.co/t/access-the-request-via-logstash-map-keys/183441 "2019-05-30T01:02:22Z")
I have the following structure: "\_index": "test", "\_type": "\_doc", "\_id": "01", "\_version": 1, "\_score": 0, "\_source": { "@timestamp": "2019-05-30T00:36:19.622Z", "type": "db\_use", "tags": \[ … --- ## [Local timezone being assumed as UTC](https://discuss.elastic.co/t/local-timezone-being-assumed-as-utc/183437)
**Author:** [@krytie](https://discuss.elastic.co/u/krytie)\ **Replies:** 0\ **Last updated:** [May 30, 2019, 12:04am UTC](https://discuss.elastic.co/t/local-timezone-being-assumed-as-utc/183437 "2019-05-30T00:04:57Z")
Hello All, i have inherited a logstash/kibana install. i am a newbie to this product. and i have been asked to fix a few problems with it. the biggest one is that our logs which are imported using filebeat are always 1… --- ## [Threat hunting/cifv4 and logstash http filter](https://discuss.elastic.co/t/threat-hunting-cifv4-and-logstash-http-filter/183429)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 0\ **Last updated:** [May 29, 2019, 11:08pm UTC](https://discuss.elastic.co/t/threat-hunting-cifv4-and-logstash-http-filter/183429 "2019-05-29T23:08:03Z")
hi, i have no idea if this is a good plan or not.. but i'm giving it a good try. There is a nice open source threat intelligence platform called cifv4 (https://csirtgadgets.com/collective-intelligence-framework/) , it h… --- ## [Split filebeat name](https://discuss.elastic.co/t/split-filebeat-name/183419)
**Author:** [@Zareh42](https://discuss.elastic.co/u/Zareh42)\ **Replies:** 2\ **Last updated:** [May 29, 2019, 8:50pm UTC](https://discuss.elastic.co/t/split-filebeat-name/183419 "2019-05-29T20:50:20Z")
I am trying to implement the filter below. And continue to get an error about Invalid FieldReference: \`%{\[beat\]\[hostname\]}\` I believe I am calling the field correctly based on the guide here filter { mutate { … --- ## [Logstash can not find JAVA\_HOME](https://discuss.elastic.co/t/logstash-can-not-find-java-home/183224)
**Author:** [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Replies:** 10\ **Last updated:** [May 29, 2019, 8:28pm UTC](https://discuss.elastic.co/t/logstash-can-not-find-java-home/183224 "2019-05-29T20:28:01Z")
Unable to install Logstash because it can not find JAVA\_HOME I did not install JAVA because it is included in ELK. Elasticsearch, Kibana and Logstash are on the same server. Elacticsearh and Kibana works. But how to co… --- ## [Logstash JSON ParserError: Unexpected characher '-'](https://discuss.elastic.co/t/logstash-json-parsererror-unexpected-characher/183400)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 2\ **Last updated:** [May 29, 2019, 6:47pm UTC](https://discuss.elastic.co/t/logstash-json-parsererror-unexpected-characher/183400 "2019-05-29T18:47:16Z")
It appears that LogStash doesn't like hyphens or something? These are IIS logs by the way. I get this error in my date field: \[2019-05-28T16:35:58,176\]\[WARN \]\[logstash.codecs.jsonlines\] JSON parse error, original data… --- ## [Multiple SNMP Inputs](https://discuss.elastic.co/t/multiple-snmp-inputs/183162)
**Author:** [@Kyle123](https://discuss.elastic.co/u/Kyle123)\ **Replies:** 0\ **Last updated:** [May 28, 2019, 6:06pm UTC](https://discuss.elastic.co/t/multiple-snmp-inputs/183162 "2019-05-28T18:06:52Z")
Hey folks, I am running into an issue with the snmp plugin dealing with multiple hosts. Whatever host is loaded 2nd is the one that actually works while the other always times out, so in my confige file hostA world work… --- ## [Zendesk link](https://discuss.elastic.co/t/zendesk-link/183389)
**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\ **Replies:** 0\ **Last updated:** [May 29, 2019, 4:45pm UTC](https://discuss.elastic.co/t/zendesk-link/183389 "2019-05-29T16:45:24Z")
Has anyone ever tried to complete this tutorial? thanks. --- ## [Invalid FieldReference with nested fields](https://discuss.elastic.co/t/invalid-fieldreference-with-nested-fields/183361)
**Author:** [@ocabj](https://discuss.elastic.co/u/ocabj)\ **Replies:** 2\ **Last updated:** [May 29, 2019, 4:28pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-with-nested-fields/183361 "2019-05-29T16:28:13Z")
So I'm sending a log file to logstash via filebeat where the log file events are written out in json. Logstash is taking them and inserting them into elasticsearch just fine from what I can tell, where various keys are … --- ## [Filebeat module + log tracking](https://discuss.elastic.co/t/filebeat-module-log-tracking/183359)
**Author:** [@itractus](https://discuss.elastic.co/u/itractus)\ **Replies:** 1\ **Last updated:** [May 29, 2019, 3:59pm UTC](https://discuss.elastic.co/t/filebeat-module-log-tracking/183359 "2019-05-29T15:59:54Z")
So, I have been playing around with an ELK stack this week. I've been able to track log files with filebeat, send them to logstash, send them on to elasticsearch and even view those in kibana. Now, since I only have a … --- ## [NoMethodError: undefined method \`\<’ for nil:NilClass\>](https://discuss.elastic.co/t/nomethoderror-undefined-method-for-nil-nilclass/183243)
**Author:** [@sadiesh](https://discuss.elastic.co/u/sadiesh)\ **Replies:** 1\ **Last updated:** [May 29, 2019, 2:57pm UTC](https://discuss.elastic.co/t/nomethoderror-undefined-method-for-nil-nilclass/183243 "2019-05-29T14:57:07Z")
date { match =\> \[ "event\_timestamp", "dd MMM yyyy HH:mm:ss,SSS" \] target =\> "event\_timestamp" add\_field =\> {"\[hour\]" =\> "%{+HH}"} add\_field =\> {"\[min\]" =\> "%{+EEE}"} } mutate{ convert =\>{ "hour" =\> "integer"} } … --- ## [Multiple Logstash pipelines](https://discuss.elastic.co/t/multiple-logstash-pipelines/181379)
**Author:** [@Costi](https://discuss.elastic.co/u/Costi)\ **Replies:** 16\ **Last updated:** [May 29, 2019, 1:43pm UTC](https://discuss.elastic.co/t/multiple-logstash-pipelines/181379 "2019-05-29T13:43:22Z")
Hi, I am using Logstash 6.5 as a service on a windows machine. I have defined a pipelines.yml file that looks like this: # List of pipelines to be loaded by Logstash - pipeline.id: filebeat path.config: "CPA/LogStash… --- ## [Seems that Logstash stop shipping logs to ES / Problem into the logstash config](https://discuss.elastic.co/t/seems-that-logstash-stop-shipping-logs-to-es-problem-into-the-logstash-config/180946)
**Author:** [@Rodolphe\_Ghio](https://discuss.elastic.co/u/Rodolphe_Ghio)\ **Replies:** 13\ **Last updated:** [May 29, 2019, 1:41pm UTC](https://discuss.elastic.co/t/seems-that-logstash-stop-shipping-logs-to-es-problem-into-the-logstash-config/180946 "2019-05-29T13:41:49Z")
Hello everyone, I'm new in the ELK community. I'm trying to setup a kibana sandbox (linux vm). So I've put data into the logstash. I've created index / mapping thanks to the Dev tool. But when I'm trying to set a defaul… --- ## [CSV files through LogStash into Elastic](https://discuss.elastic.co/t/csv-files-through-logstash-into-elastic/183340)
**Author:** [@userelastic](https://discuss.elastic.co/u/userelastic)\ **Replies:** 0\ **Last updated:** [May 29, 2019, 1:38pm UTC](https://discuss.elastic.co/t/csv-files-through-logstash-into-elastic/183340 "2019-05-29T13:38:22Z")
Hi; I have a CSV file which I am trying to get into Elastic through Logstash. I am using filebeat to get file into the Logstash. I can see in the filebeat log that CSV file is processed successfully. Logstash does not sh… --- ## ["Cannot allocate memory" in Logstash exec plugin](https://discuss.elastic.co/t/cannot-allocate-memory-in-logstash-exec-plugin/182912)
**Author:** [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Replies:** 3\ **Last updated:** [May 29, 2019, 12:57pm UTC](https://discuss.elastic.co/t/cannot-allocate-memory-in-logstash-exec-plugin/182912 "2019-05-29T12:57:52Z")
I use the Logstash exec plugin to dump info about our running database process every 10s. This has worked fine over the last weeks, but now on one host it failed to report data. Checking the Logstash logs, I see this er… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=537) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=539)