# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=554 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 555 --- ## [\[HELP\] I Broke my logstash.yml](https://discuss.elastic.co/t/help-i-broke-my-logstash-yml/179440)
**Author:** [@TiNhO](https://discuss.elastic.co/u/TiNhO)\ **Replies:** 5\ **Last updated:** [May 3, 2019, 7:13pm UTC](https://discuss.elastic.co/t/help-i-broke-my-logstash-yml/179440 "2019-05-03T19:13:47Z")
I'm trying use multiple pipelines and made some modifications in logstash.yml and now i get this error: Sending Logstash logs to /opt/bitnami/logstash/logs which is now configured via log4j2.properties \[2019-05-02T18:47… --- ## [Wich is the best way to parse logs with XML seccion](https://discuss.elastic.co/t/wich-is-the-best-way-to-parse-logs-with-xml-seccion/179556)
**Author:** [@fcalegari](https://discuss.elastic.co/u/fcalegari)\ **Replies:** 1\ **Last updated:** [May 3, 2019, 6:01pm UTC](https://discuss.elastic.co/t/wich-is-the-best-way-to-parse-logs-with-xml-seccion/179556 "2019-05-03T18:01:25Z")
Hi , I'm triying to send a app log to logatash, the problem is that this logs have XML sections in multilines. example: 2019-05-03 12:11:36,746 \[xxxxxxxxx\] INFO Command - GetReport Command receive, Id \[xxxxxxxxxx\], re… --- ## [XML, how to filter desire parameter?](https://discuss.elastic.co/t/xml-how-to-filter-desire-parameter/179569)
**Author:** [@hannkeat](https://discuss.elastic.co/u/hannkeat)\ **Replies:** 0\ **Last updated:** [May 3, 2019, 5:36pm UTC](https://discuss.elastic.co/t/xml-how-to-filter-desire-parameter/179569 "2019-05-03T17:36:58Z")
Hi All, I have parse XML into json, and wish to filter only the require parameter which is MSISDN "RequestBody": \[ { "ProvisionNewServicesInRealTimeOrderReqParams": \[ { "OrderRequestBody": \[ { … --- ## [Logstash Jdbc oracle issue](https://discuss.elastic.co/t/logstash-jdbc-oracle-issue/179223)
**Author:** [@hannkeat](https://discuss.elastic.co/u/hannkeat)\ **Replies:** 10\ **Last updated:** [May 3, 2019, 4:07pm UTC](https://discuss.elastic.co/t/logstash-jdbc-oracle-issue/179223 "2019-05-03T16:07:23Z")
Here is my input file logstash 6.7 ojdbc8 input { jdbc { jdbc\_driver\_library =\> "/usr/lib/oracle/18.3/client64/lib/ojdbc8.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> … --- ## [Grok formatting help](https://discuss.elastic.co/t/grok-formatting-help/179406)
**Author:** [@JB\_Pollard](https://discuss.elastic.co/u/JB_Pollard)\ **Replies:** 5\ **Last updated:** [May 3, 2019, 2:57pm UTC](https://discuss.elastic.co/t/grok-formatting-help/179406 "2019-05-03T14:57:06Z")
Just getting started with elastic this is my second attempt now that I have some free time I'm getting somewhere with it. Having some trouble finding the correct way to format my grok to correctly grab the fields. Main … --- ## [Logstash 7.0.0 not indexing on Elasticsearch 7.0.0](https://discuss.elastic.co/t/logstash-7-0-0-not-indexing-on-elasticsearch-7-0-0/179552)
**Author:** [@kazenokoe](https://discuss.elastic.co/u/kazenokoe)\ **Replies:** 0\ **Last updated:** [May 3, 2019, 2:40pm UTC](https://discuss.elastic.co/t/logstash-7-0-0-not-indexing-on-elasticsearch-7-0-0/179552 "2019-05-03T14:40:53Z")
I'm running docker filebeat:7.0.0 =\> docker logstash:7.0.0 =\> docker elasticsearch 7.0.0 =\> docker kibana 7.0.0 I can see the logs move from filebeat to logstash, but nothing from logstash to elasticsearch, no indexes a… --- ## [Multiple outputs for same log entry](https://discuss.elastic.co/t/multiple-outputs-for-same-log-entry/179312)
**Author:** [@duncOps](https://discuss.elastic.co/u/duncOps)\ **Replies:** 5\ **Last updated:** [May 3, 2019, 1:42pm UTC](https://discuss.elastic.co/t/multiple-outputs-for-same-log-entry/179312 "2019-05-03T13:42:49Z")
Hi folks, I've recently written a couple of email module output blocks to notify Teams / PagerDuty when errors occur in our live environment. My Logstash output looks like this: output { if "PROD" in \[log.environmen… --- ## [Logstash behaviour when deleting and adding the same file](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489)
**Author:** [@gued](https://discuss.elastic.co/u/gued)\ **Replies:** 5\ **Last updated:** [May 3, 2019, 12:56pm UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489 "2019-05-03T12:56:44Z")
Hello, I am not sure about Logstash's behaviour when faced with the following example: Suppose you have a file with \> 100 lines of input. Logstash indexes this and the file is removed. What will logstash do if the same … --- ## [Logstash output to NFS](https://discuss.elastic.co/t/logstash-output-to-nfs/179517)
**Author:** [@LaurentGisaia](https://discuss.elastic.co/u/LaurentGisaia)\ **Replies:** 1\ **Last updated:** [May 3, 2019, 12:44pm UTC](https://discuss.elastic.co/t/logstash-output-to-nfs/179517 "2019-05-03T12:44:14Z")
Hi, I can't find a relevant answer to this question. As I understand it, Logstash can hardly read from NFS (there might be troubles). However is it OK to write in a NFS hosted file? My stack would be Java -\> Kafka -\> L… --- ## [Split not working as expected](https://discuss.elastic.co/t/split-not-working-as-expected/179373)
**Author:** [@ghost3h](https://discuss.elastic.co/u/ghost3h)\ **Replies:** 3\ **Last updated:** [May 3, 2019, 12:35pm UTC](https://discuss.elastic.co/t/split-not-working-as-expected/179373 "2019-05-03T12:35:42Z")
Hi All, I'm having a issue with my split on a field that is comma deliminated. I've got the syntax for what I want from previous questions, but the output is not as I expected. I have seen different syntax used on the … --- ## [Logstash Could not index event to Elasticsearch The \[default\] mapping cannot be updated on index](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch-the-default-mapping-cannot-be-updated-on-index/177315)
**Author:** [@Moshe\_Nadler](https://discuss.elastic.co/u/Moshe_Nadler)\ **Replies:** 5\ **Last updated:** [May 3, 2019, 10:53am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch-the-default-mapping-cannot-be-updated-on-index/177315 "2019-05-03T10:53:00Z")
After an upgrade to elastic stack 7 Logstash cannot send logs to elasticsearch any more. We see the following error: \[2019-04-17T14:25:31,292\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearc… --- ## [Inserting several grok filters in one logstash conf file](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497)
**Author:** [@gerardo\_aliberti](https://discuss.elastic.co/u/gerardo_aliberti)\ **Replies:** 3\ **Last updated:** [May 3, 2019, 10:45am UTC](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497 "2019-05-03T10:45:10Z")
Hello guys, I'm having an error when adding a grok filter to my logstash config: \[FATAL\] 2019-05-03 09:53:36.256 \[LogStash::Runner\] runner - The given configuration is invalid. Reason: Expected one of #, {, ,, \] at lin… --- ## [Elasticsearch Filter - Daily index search](https://discuss.elastic.co/t/elasticsearch-filter-daily-index-search/179494)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 0\ **Last updated:** [May 3, 2019, 8:18am UTC](https://discuss.elastic.co/t/elasticsearch-filter-daily-index-search/179494 "2019-05-03T08:18:46Z")
When using the elasticsearch filter plugin to query previous documents, I'm wondering if there is an option to specify the previous days index. For example, I have the below filter: filter { elasticsearch { … --- ## [How to read kernel log in logstash?](https://discuss.elastic.co/t/how-to-read-kernel-log-in-logstash/179177)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 6\ **Last updated:** [May 3, 2019, 6:45am UTC](https://discuss.elastic.co/t/how-to-read-kernel-log-in-logstash/179177 "2019-05-03T06:45:24Z")
Please help me to understand that how to read kernel logs using logstash in version 5.0 is there any input plugins ? --- ## [Can we send parsing event in any of sql like oracle using output plugin](https://discuss.elastic.co/t/can-we-send-parsing-event-in-any-of-sql-like-oracle-using-output-plugin/179482)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 0\ **Last updated:** [May 3, 2019, 6:37am UTC](https://discuss.elastic.co/t/can-we-send-parsing-event-in-any-of-sql-like-oracle-using-output-plugin/179482 "2019-05-03T06:37:55Z")
Please help me to figure out. --- ## [Can't recieve filebeat logs via Logstash](https://discuss.elastic.co/t/cant-recieve-filebeat-logs-via-logstash/177893)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 15\ **Last updated:** [May 3, 2019, 4:37am UTC](https://discuss.elastic.co/t/cant-recieve-filebeat-logs-via-logstash/177893 "2019-05-03T04:37:28Z")
Hi, I have a problem with recieving logs via logstash from filebeat. I can recieve them directly to elasticsearch but not via Logastash. Logstash conf.d input file: input { beats { type =\> "filebeat" … --- ## [Error connecting to secured ES cluster from logstash.filters.elasticsearch](https://discuss.elastic.co/t/error-connecting-to-secured-es-cluster-from-logstash-filters-elasticsearch/179457)
**Author:** [@maavericc](https://discuss.elastic.co/u/maavericc)\ **Replies:** 0\ **Last updated:** [May 3, 2019, 4:20am UTC](https://discuss.elastic.co/t/error-connecting-to-secured-es-cluster-from-logstash-filters-elasticsearch/179457 "2019-05-03T04:20:16Z")
When I am trying to connect to secured ES cluster from logstash.filters.elasticsearch, getting this error: \[2019-05-03T04:15:34,613\]\[WARN \]\[logstash.filters.elasticsearch\] Failed to query elasticsearch for previous even… --- ## [Is multiline codec safe to use in TCP input?](https://discuss.elastic.co/t/is-multiline-codec-safe-to-use-in-tcp-input/179449)
**Author:** [@vbohata](https://discuss.elastic.co/u/vbohata)\ **Replies:** 0\ **Last updated:** [May 3, 2019, 1:47am UTC](https://discuss.elastic.co/t/is-multiline-codec-safe-to-use-in-tcp-input/179449 "2019-05-03T01:47:16Z")
Docs warns about using the multiline codec in beats inputs etc. because of mixing up data. As tcp input already uses line codec and the events processing seems to be related/separated to each network socket it should be … --- ## [Date-filter - Issue with setting @timestamp with the value from my log](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 9\ **Last updated:** [May 2, 2019, 10:42pm UTC](https://discuss.elastic.co/t/date-filter-issue-with-setting-timestamp-with-the-value-from-my-log/179433 "2019-05-02T22:42:48Z")
Hi Lads, First of all i'm a newbie here......... I was trying to format below log entry 2019-04-29 12:47:46.679.9882 - log message "blah blah blah" i was testing it with below stdin input { stdin { } } filter { … --- ## [Date parse failure, cannot figure out pattern for literal characters in time stamp field](https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412)
**Author:** [@tomj](https://discuss.elastic.co/u/tomj)\ **Replies:** 2\ **Last updated:** [May 2, 2019, 8:37pm UTC](https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412 "2019-05-02T20:37:30Z")
Using Logstash 6.4.3 I am processing Kinesis records from the Kinesis input plugin, where the 'timestamp' field looks like this: 2019-05-02T16:25:17.850884549Z I am using the following date filter syntax (following su… --- ## [Retrive data from keyboard in logstash](https://discuss.elastic.co/t/retrive-data-from-keyboard-in-logstash/179205)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 0\ **Last updated:** [May 1, 2019, 1:34pm UTC](https://discuss.elastic.co/t/retrive-data-from-keyboard-in-logstash/179205 "2019-05-01T13:34:26Z")
hi my friends, i am in ubuntu i have installed elasticsearch, logstash and kibana; and now i want to retrieve data not from log but from keyboard (sdin) and display the retrived text in kibana, can you give help about h… --- ## [Logstash stuck at Successfully started Logstash API](https://discuss.elastic.co/t/logstash-stuck-at-successfully-started-logstash-api/179097)
**Author:** [@Chaitra\_Muniyappa](https://discuss.elastic.co/u/Chaitra_Muniyappa)\ **Replies:** 3\ **Last updated:** [May 2, 2019, 7:31pm UTC](https://discuss.elastic.co/t/logstash-stuck-at-successfully-started-logstash-api/179097 "2019-05-02T19:31:33Z")
HI, I am trying to load a CSV file into Elastic Search using logstash. I previously loaded it but deleted the index and loading with document type field. But now i am stuck at Successfully started Logstash API endpoint… --- ## [Aggregate filter not working in csv output plugin](https://discuss.elastic.co/t/aggregate-filter-not-working-in-csv-output-plugin/179298)
**Author:** [@Smack\_Alpha](https://discuss.elastic.co/u/Smack_Alpha)\ **Replies:** 1\ **Last updated:** [May 2, 2019, 7:02pm UTC](https://discuss.elastic.co/t/aggregate-filter-not-working-in-csv-output-plugin/179298 "2019-05-02T19:02:04Z")
I am using aggregate to merge similar data in to one in my csv file. I read the guide of aggregate filter and i wrote the config file according to my need. Here's my csv file: |state|city|haps|ads| |---|---|---|---| … --- ## [Unable to use (save) "modified" column value as sql\_last\_value](https://discuss.elastic.co/t/unable-to-use-save-modified-column-value-as-sql-last-value/179427)
**Author:** [@ParitoshBh](https://discuss.elastic.co/u/ParitoshBh)\ **Replies:** 0\ **Last updated:** [May 2, 2019, 6:57pm UTC](https://discuss.elastic.co/t/unable-to-use-save-modified-column-value-as-sql-last-value/179427 "2019-05-02T18:57:38Z")
Among other things, following is an input which worked without any issue in version 5.6.5, jdbc { jdbc\_driver\_library =\> "/etc/logstash/mssql-jdbc-6.2.2.jre8.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.… --- ## [Parse inner objects and assign all value to fields](https://discuss.elastic.co/t/parse-inner-objects-and-assign-all-value-to-fields/179272)
**Author:** [@yuva\_rajan](https://discuss.elastic.co/u/yuva_rajan)\ **Replies:** 1\ **Last updated:** [May 2, 2019, 6:38pm UTC](https://discuss.elastic.co/t/parse-inner-objects-and-assign-all-value-to-fields/179272 "2019-05-02T18:38:50Z")
Hi, Below is my complete json events. { "\_index": "text\_2019.05", "\_type": "doc", "\_id": "K7cldmoBJfAjCSoFDrmP", "\_version": 1, "\_score": null, "\_size": 2494, "\_source": { "@timestamp": "2019-05-02T01… --- ## [\[Help\] Multiple pipelines with N logs from filebeat and N servers](https://discuss.elastic.co/t/help-multiple-pipelines-with-n-logs-from-filebeat-and-n-servers/179159)
**Author:** [@TiNhO](https://discuss.elastic.co/u/TiNhO)\ **Replies:** 2\ **Last updated:** [May 2, 2019, 2:41pm UTC](https://discuss.elastic.co/t/help-multiple-pipelines-with-n-logs-from-filebeat-and-n-servers/179159 "2019-05-02T14:41:49Z")
I have this structure: \_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_ |same name | |same name | | same name | |-… --- ## [MongoDB failed to send event](https://discuss.elastic.co/t/mongodb-failed-to-send-event/179266)
**Author:** [@gx0s](https://discuss.elastic.co/u/gx0s)\ **Replies:** 2\ **Last updated:** [May 2, 2019, 2:04pm UTC](https://discuss.elastic.co/t/mongodb-failed-to-send-event/179266 "2019-05-02T14:04:47Z")
Hi, I am getting this error on logstash \[WARN \] 2019-05-01 23:01:42.484 \[\[main\]\>worker1\] mongodb - Failed to send event to MongoDB, retrying in 3 seconds {:event=\>#LogStash::Event:0x527d46ff, :exception=\>java.lang.Null… --- ## [Logstash 7.0 does ignore index\_patterns / template fields in template and overrules that with "logstash-\*"](https://discuss.elastic.co/t/logstash-7-0-does-ignore-index-patterns-template-fields-in-template-and-overrules-that-with-logstash/179341)
**Author:** [@seilre](https://discuss.elastic.co/u/seilre)\ **Replies:** 1\ **Last updated:** [May 2, 2019, 11:37am UTC](https://discuss.elastic.co/t/logstash-7-0-does-ignore-index-patterns-template-fields-in-template-and-overrules-that-with-logstash/179341 "2019-05-02T11:37:13Z")
I was using elastic stack 6.52 before and upgraded to 7.0 recently. Now it seems that my index templates are no longer updated correctly. I use the elasticsearch output plugin to install my template with following confi… --- ## [Converting hexadecimal input into timestamp](https://discuss.elastic.co/t/converting-hexadecimal-input-into-timestamp/179065)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 8\ **Last updated:** [May 2, 2019, 8:50am UTC](https://discuss.elastic.co/t/converting-hexadecimal-input-into-timestamp/179065 "2019-05-02T08:50:18Z")
I have a qmail server logs where the timestamp is given in different hexadecimal format how can i concert this again in timestamp???? @400000005cc363f11d3becc4 sslserver: pid 4983 from 209.85.210.174 --- ## [How to send an email using logstash only if your log message has particular string](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 4\ **Last updated:** [May 2, 2019, 7:12am UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197 "2019-05-02T07:12:28Z")
HI , My requirement is to email the logs that match only a particular sub string in a message . By removing the if condition in the below code i am able to receive email notification which means the code is working but… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=553) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=555)