# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=553 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 554 --- ## [Does purchasing an elastic license include logstash technical support?](https://discuss.elastic.co/t/does-purchasing-an-elastic-license-include-logstash-technical-support/179861)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [May 7, 2019, 1:09am UTC](https://discuss.elastic.co/t/does-purchasing-an-elastic-license-include-logstash-technical-support/179861 "2019-05-07T01:09:35Z")
Does purchasing an elastic license include logstash technical support? --- ## [Logstash.instrument.periodicpoller.jvm purpose / how to disable via logstash settings?](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-jvm-purpose-how-to-disable-via-logstash-settings/179857)
**Author:** [@bgeels](https://discuss.elastic.co/u/bgeels)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 11:02pm UTC](https://discuss.elastic.co/t/logstash-instrument-periodicpoller-jvm-purpose-how-to-disable-via-logstash-settings/179857 "2019-05-06T23:02:40Z")
Hi All, I'm trying to diagnose where time is going starting up my logstash instance. I have multiple pipelines with many filters in each. Watching the debug logs I see many statements like the below ( I'm not positive … --- ## [Two indexes receiving same content regardless of logstash conf files](https://discuss.elastic.co/t/two-indexes-receiving-same-content-regardless-of-logstash-conf-files/179828)
**Author:** [@heyabbottb](https://discuss.elastic.co/u/heyabbottb)\ **Replies:** 3\ **Last updated:** [May 6, 2019, 7:14pm UTC](https://discuss.elastic.co/t/two-indexes-receiving-same-content-regardless-of-logstash-conf-files/179828 "2019-05-06T19:14:01Z")
I've got two Logstash configuration files that each specify a different location for log files and then define the index for said log files. The first: input { file { path =\> "/elk/nmap/results/puppetserver/full/… --- ## [Apache logs by virtualhost in ELK 6.7](https://discuss.elastic.co/t/apache-logs-by-virtualhost-in-elk-6-7/179822)
**Author:** [@Victor\_Guerrero](https://discuss.elastic.co/u/Victor_Guerrero)\ **Replies:** 2\ **Last updated:** [May 6, 2019, 6:50pm UTC](https://discuss.elastic.co/t/apache-logs-by-virtualhost-in-elk-6-7/179822 "2019-05-06T18:50:38Z")
Hi community, I spent a couple of days looking for a solution without luck. I have a server with different domains hosted, also known as virtual host, running Apache2 as front server. Each domain has their own logs wit… --- ## [Parsing multiple log format in same file](https://discuss.elastic.co/t/parsing-multiple-log-format-in-same-file/179825)
**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Replies:** 1\ **Last updated:** [May 6, 2019, 6:40pm UTC](https://discuss.elastic.co/t/parsing-multiple-log-format-in-same-file/179825 "2019-05-06T18:40:50Z")
I have a log file as in this link which is a composite log format that consists of key value pairs with '=' as the delimiter and csv type of rows with headers which are tab seperated. Still lost on how to parse these log… --- ## [Logstash is unable to process json file](https://discuss.elastic.co/t/logstash-is-unable-to-process-json-file/179393)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 6\ **Last updated:** [May 6, 2019, 4:08pm UTC](https://discuss.elastic.co/t/logstash-is-unable-to-process-json-file/179393 "2019-05-06T16:08:02Z")
Hi All, We are trying to load a json file into elasticsearch using logstash, its just a direct upload but which is not happening neither i get errors also, seems like it got stuck somewhere i'm not able to break it down… --- ## [Aggregation multiple log entry](https://discuss.elastic.co/t/aggregation-multiple-log-entry/179515)
**Author:** [@Shawcs](https://discuss.elastic.co/u/Shawcs)\ **Replies:** 7\ **Last updated:** [May 6, 2019, 3:59pm UTC](https://discuss.elastic.co/t/aggregation-multiple-log-entry/179515 "2019-05-06T15:59:20Z")
hello everyone ! So I'm struggling with aggregation in logstash. Here is my problem: I have an API platform that log all the call and when a call is made it generate 3 or 4 row of log. I'd like to aggregate those multi… --- ## [Pipeline to Pipeline Output Variable Expansion](https://discuss.elastic.co/t/pipeline-to-pipeline-output-variable-expansion/179809)
**Author:** [@jstubbington](https://discuss.elastic.co/u/jstubbington)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 3:56pm UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-output-variable-expansion/179809 "2019-05-06T15:56:39Z")
Hello, I'm trying to organize/refactor our Logstash (6.5.4) pipelines by using the Pipeline-to-Pipeline beta feature. We ingest a lot of custom log formats in addition to logs from the Filebeat (6.5.4) modules, so I hav… --- ## [Support for other maxmind sources](https://discuss.elastic.co/t/support-for-other-maxmind-sources/179793)
**Author:** [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\ **Replies:** 1\ **Last updated:** [May 6, 2019, 3:32pm UTC](https://discuss.elastic.co/t/support-for-other-maxmind-sources/179793 "2019-05-06T15:32:13Z")
The logstash docs says other commercial versions of the plugin are supported. Im using the GeoIP2-Domain plugin, but I get these errors when I run logstash. \[LogStash::Runner\] runner - An unexpected error occurred! {:e… --- ## [Filter on tag value in filter](https://discuss.elastic.co/t/filter-on-tag-value-in-filter/179783)
**Author:** [@Dennis\_Brouwer1](https://discuss.elastic.co/u/Dennis_Brouwer1)\ **Replies:** 1\ **Last updated:** [May 6, 2019, 2:49pm UTC](https://discuss.elastic.co/t/filter-on-tag-value-in-filter/179783 "2019-05-06T14:49:15Z")
Hello, I know that i can filter on specific tags in Logstash with an IF, but i don't want to filter on the tag names, i want to filter on what a tag contains. So if tag "environment" == "production" then i want to do so… --- ## [Question regarding Logstash Horizontal Scaling](https://discuss.elastic.co/t/question-regarding-logstash-horizontal-scaling/179768)
**Author:** [@krokodil](https://discuss.elastic.co/u/krokodil)\ **Replies:** 4\ **Last updated:** [May 6, 2019, 2:07pm UTC](https://discuss.elastic.co/t/question-regarding-logstash-horizontal-scaling/179768 "2019-05-06T14:07:47Z")
Hi All, Hope I can get some clarity on the documentation supplied by Logstash. We're looking at implementing high availability for Logstash (Elasticsearch clustering is working fine). As per the Logstash documentation… --- ## [Simple question - http input plugin](https://discuss.elastic.co/t/simple-question-http-input-plugin/179649)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 4\ **Last updated:** [May 6, 2019, 1:20pm UTC](https://discuss.elastic.co/t/simple-question-http-input-plugin/179649 "2019-05-06T13:20:36Z")
Hi there, I have a kind of newbie question regarding the http input plugin. The option host says: The host or ip to bind. I changed the default value from 0.0.0.0 to 192.168.56.112. On this ip I have a virtual box test… --- ## [Process 200 events per second within 100ms](https://discuss.elastic.co/t/process-200-events-per-second-within-100ms/178816)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 4\ **Last updated:** [May 6, 2019, 1:10pm UTC](https://discuss.elastic.co/t/process-200-events-per-second-within-100ms/178816 "2019-05-06T13:10:39Z")
I have a use case in which I have to process 200 events/second and each event should not take more than 100 ms to process. I have used NIFI for this and it is taking around 500 ms for an event to complete an I am planni… --- ## [Change timestamp format](https://discuss.elastic.co/t/change-timestamp-format/179756)
**Author:** [@chaire](https://discuss.elastic.co/u/chaire)\ **Replies:** 1\ **Last updated:** [May 6, 2019, 12:54pm UTC](https://discuss.elastic.co/t/change-timestamp-format/179756 "2019-05-06T12:54:01Z")
Hi. I've searched the forum for similar problems but I found no solution. I want to change my timestamp format from "MMM/dd/yyyy HH:mm:ss Z" to "yyyy-MM-dd HH:mm:ss". How do I do it in Logstash? I need this because I'm … --- ## [Split and Substring](https://discuss.elastic.co/t/split-and-substring/179536)
**Author:** [@Akhraht](https://discuss.elastic.co/u/Akhraht)\ **Replies:** 5\ **Last updated:** [May 6, 2019, 12:53pm UTC](https://discuss.elastic.co/t/split-and-substring/179536 "2019-05-06T12:53:41Z")
Hello guys, I have a group of strings like "lorem","ipsum", i wanna only "um" part of the string how i can do it i tried mutate filter and split, split give me array but i need last two char of the array filter { mu… --- ## [RabbitMQ output using SSL in Logstash](https://discuss.elastic.co/t/rabbitmq-output-using-ssl-in-logstash/179762)
**Author:** [@manuelm](https://discuss.elastic.co/u/manuelm)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 12:05pm UTC](https://discuss.elastic.co/t/rabbitmq-output-using-ssl-in-logstash/179762 "2019-05-06T12:05:59Z")
I'm trying to use SSL in the communication between RabbitMQ (output) and Logstash, However when I run Logstash I get the error message: \[ERROR\] 2019-05-06 07:58:01.228 \[\[main\]-pipeline-manager\] rabbitmq - RabbitMQ conne… --- ## [How to use elapsed filter- logstash](https://discuss.elastic.co/t/how-to-use-elapsed-filter-logstash/179743)
**Author:** [@Smack\_Alpha](https://discuss.elastic.co/u/Smack_Alpha)\ **Replies:** 5\ **Last updated:** [May 6, 2019, 11:38am UTC](https://discuss.elastic.co/t/how-to-use-elapsed-filter-logstash/179743 "2019-05-06T11:38:40Z")
I am working in the Elapsed filter. I read the guide of Elapsed filter in logstash. then i made a sample config file and csv to test the working of Elapsed filter. But it seems to be not working. There is no change in up… --- ## [Slow ingestion using Logstash Filebeat output with Kubernetes autodiscovery](https://discuss.elastic.co/t/slow-ingestion-using-logstash-filebeat-output-with-kubernetes-autodiscovery/176466)
**Author:** [@bagratte](https://discuss.elastic.co/u/bagratte)\ **Replies:** 1\ **Last updated:** [May 6, 2019, 11:04am UTC](https://discuss.elastic.co/t/slow-ingestion-using-logstash-filebeat-output-with-kubernetes-autodiscovery/176466 "2019-05-06T11:04:40Z")
I am using Elastic Stack for harvesting logs of a Kubernetes cluster. Elastic Stack is installed in the same cluster and I'm using Filebeat's Kubernetes autodiscover. Elastic Stack consists of an Elasticsearch cluster wi… --- ## [Ruby\_exception - no implicit conversion of nil into string](https://discuss.elastic.co/t/ruby-exception-no-implicit-conversion-of-nil-into-string/179742)
**Author:** [@nane96](https://discuss.elastic.co/u/nane96)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 10:27am UTC](https://discuss.elastic.co/t/ruby-exception-no-implicit-conversion-of-nil-into-string/179742 "2019-05-06T10:27:58Z")
Hey, so I have this logstash conf-file with a part of ruby code in it that I mainly got though the help from one of you guys (managed to add one thing myself). ruby { code =\> ' e = event.get("… --- ## [How to use Logstash to import csv file into elasticsearch](https://discuss.elastic.co/t/how-to-use-logstash-to-import-csv-file-into-elasticsearch/179727)
**Author:** [@idris](https://discuss.elastic.co/u/idris)\ **Replies:** 4\ **Last updated:** [May 6, 2019, 8:26am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-import-csv-file-into-elasticsearch/179727 "2019-05-06T08:26:11Z")
Need help guys, i need to store data (csv file) on elasticsearch , but i m confused about the way to do that . May i have to install firstly logstash on docker compose and try configure it manually??? What are the ma… --- ## [Parsing Cisco ASA Log](https://discuss.elastic.co/t/parsing-cisco-asa-log/179726)
**Author:** [@Omar\_Alshair](https://discuss.elastic.co/u/Omar_Alshair)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 8:01am UTC](https://discuss.elastic.co/t/parsing-cisco-asa-log/179726 "2019-05-06T08:01:58Z")
I'm trying to parse Cisco logs to only show message 106023 and 106100 which are the permitted traffic and the denied traffic. I've been having an issue with my configuration, can someone take a look at it I'm not sure wh… --- ## [Http output error PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target](https://discuss.elastic.co/t/http-output-error-pkix-path-building-failed-sun-security-provider-certpath-suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/179709)
**Author:** [@jfreeman](https://discuss.elastic.co/u/jfreeman)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 6:40am UTC](https://discuss.elastic.co/t/http-output-error-pkix-path-building-failed-sun-security-provider-certpath-suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/179709 "2019-05-06T06:40:08Z")
I have downloaded and installed Logstash 7.0.1 and using nssm.exe I have setup Logstash in windows machine. I have two questions. Why am I not able to access the logstash http host url using https, but only as http:/… --- ## [Logstash 7 Error \`elasticsearch - Failed to install template. {:message=\>"undefined method\` update’ for nil:NilClass”, :class=\>“NoMethodError”, :backtrace](https://discuss.elastic.co/t/logstash-7-error-elasticsearch-failed-to-install-template-message-undefined-method-update-for-nil-nilclass-class-nomethoderror-backtrace/179703)
**Author:** [@DzhezhoraAndrey](https://discuss.elastic.co/u/DzhezhoraAndrey)\ **Replies:** 0\ **Last updated:** [May 6, 2019, 5:59am UTC](https://discuss.elastic.co/t/logstash-7-error-elasticsearch-failed-to-install-template-message-undefined-method-update-for-nil-nilclass-class-nomethoderror-backtrace/179703 "2019-05-06T05:59:51Z")
Hello :wave: I have two servers with the same installation of ELK 7 but first working as expected and second throwing this exception in logstash logs \[2019-05-03T07:24:43,774\]\[INFO \]\[logstash.runner \] Sta… --- ## [Application order of gsub](https://discuss.elastic.co/t/application-order-of-gsub/179006)
**Author:** [@GGUERRA](https://discuss.elastic.co/u/GGUERRA)\ **Replies:** 2\ **Last updated:** [May 5, 2019, 9:34pm UTC](https://discuss.elastic.co/t/application-order-of-gsub/179006 "2019-05-05T21:34:03Z")
Hi everyone, I would like to ask you a question about the gsub filter. Replacements are applied in the order set in the array? I have the following filter: mutate { gsub =\> \["message", "\\"\\"", "NULL", … --- ## [Detect when logstash is finished when using elasticsearch input filter](https://discuss.elastic.co/t/detect-when-logstash-is-finished-when-using-elasticsearch-input-filter/179639)
**Author:** [@nufje](https://discuss.elastic.co/u/nufje)\ **Replies:** 2\ **Last updated:** [May 5, 2019, 6:35pm UTC](https://discuss.elastic.co/t/detect-when-logstash-is-finished-when-using-elasticsearch-input-filter/179639 "2019-05-05T18:35:39Z")
Hello, Is there a possiblity to detect if logstash is finished when using elasticsearch input filter. I already know about the options when using file and stdin input filter. And if not, what alternatives do i have. H… --- ## [log4j:WARN No appenders could be found for logger (org.apache.kafka.clients.consumer.ConsumerConfig). log4j:WARN Please initialize the log4j system properly](https://discuss.elastic.co/t/log4j-warn-no-appenders-could-be-found-for-logger-org-apache-kafka-clients-consumer-consumerconfig-log4j-warn-please-initialize-the-log4j-system-properly/179678)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 0\ **Last updated:** [May 5, 2019, 3:26pm UTC](https://discuss.elastic.co/t/log4j-warn-no-appenders-could-be-found-for-logger-org-apache-kafka-clients-consumer-consumerconfig-log4j-warn-please-initialize-the-log4j-system-properly/179678 "2019-05-05T15:26:21Z")
I am getting below eror while connecting to Kafka from logstash 5.2.1 and kaka input plugin 5.6.1 B log4j:WARN No appenders could be found for logger Preformatted text (org.apache.kafka.clients.consumer.ConsumerConfi… --- ## [Repository for logs](https://discuss.elastic.co/t/repository-for-logs/179575)
**Author:** [@benqxf](https://discuss.elastic.co/u/benqxf)\ **Replies:** 5\ **Last updated:** [May 5, 2019, 1:18am UTC](https://discuss.elastic.co/t/repository-for-logs/179575 "2019-05-05T01:18:17Z")
I receive about 2-3GB of weekly machine (software application) logs to troubleshoot. I'm in a limited budget and I am trying to learn Elasticsearch, Logstash, Filebeat how to store and archive these logs in a common rep… --- ## [Why do logstash's internal logs and stdout end up in /var/log/messages?](https://discuss.elastic.co/t/why-do-logstashs-internal-logs-and-stdout-end-up-in-var-log-messages/179485)
**Author:** [@nick-george](https://discuss.elastic.co/u/nick-george)\ **Replies:** 2\ **Last updated:** [May 4, 2019, 2:37am UTC](https://discuss.elastic.co/t/why-do-logstashs-internal-logs-and-stdout-end-up-in-var-log-messages/179485 "2019-05-04T02:37:54Z")
Version: 6.7.2 (RPM) Running on RHEL/Centos. It seems to me that the default configuration of logstash is that every line that is logged to /var/log/logstash/logstash-plain.log also ends up in /var/log/messages. Is that… --- ## [Configuring Phonetic Analyzer via Logstash](https://discuss.elastic.co/t/configuring-phonetic-analyzer-via-logstash/179591)
**Author:** [@apremgeorge](https://discuss.elastic.co/u/apremgeorge)\ **Replies:** 1\ **Last updated:** [May 3, 2019, 10:06pm UTC](https://discuss.elastic.co/t/configuring-phonetic-analyzer-via-logstash/179591 "2019-05-03T22:06:04Z")
I have the below logstash config file(windows) to index a csv, i have the address field and i want to use the phonetic matching in address field, may i know how to configure phonetic analyzer and define phonetic field vi… --- ## [Jdbc-streaming plugin. When Database Down](https://discuss.elastic.co/t/jdbc-streaming-plugin-when-database-down/179579)
**Author:** [@ljones](https://discuss.elastic.co/u/ljones)\ **Replies:** 0\ **Last updated:** [May 3, 2019, 7:33pm UTC](https://discuss.elastic.co/t/jdbc-streaming-plugin-when-database-down/179579 "2019-05-03T19:33:33Z")
We are using this plugin to add a tag to a log. It's working perfectly. But when the database is down. Instead of giving an empty value to the tag. Logstash does not pocess de log alltogether. And we are loosing data in… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=552) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=554)