# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=560 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 561 --- ## [File input plugin not working](https://discuss.elastic.co/t/file-input-plugin-not-working/178058)
**Author:** [@Enigma\_666](https://discuss.elastic.co/u/Enigma_666)\ **Replies:** 2\ **Last updated:** [April 23, 2019, 3:00pm UTC](https://discuss.elastic.co/t/file-input-plugin-not-working/178058 "2019-04-23T15:00:33Z")
Hi , I'm using Logstash with docker to send apache logs to elasticsearch , when I use beats plugin as input it's works fine , but when I try file input plugin , nothing happens , there is no indices in elasticsearch , t… --- ## [Elasticsearch Output Script - Append to array](https://discuss.elastic.co/t/elasticsearch-output-script-append-to-array/177471)
**Author:** [@AshPowell](https://discuss.elastic.co/u/AshPowell)\ **Replies:** 1\ **Last updated:** [April 23, 2019, 1:52pm UTC](https://discuss.elastic.co/t/elasticsearch-output-script-append-to-array/177471 "2019-04-23T13:52:43Z")
We have a JDBC input that brings in records, we would like this to do one of two things depending on certain scenarios. If there is already an array in the master record in Elasticsearch (let's say fieldA.fieldB.fieldC.… --- ## [Error while executing query for loading lookup data in jdbc static plug-in](https://discuss.elastic.co/t/error-while-executing-query-for-loading-lookup-data-in-jdbc-static-plug-in/177902)
**Author:** [@rohitjejurikar](https://discuss.elastic.co/u/rohitjejurikar)\ **Replies:** 1\ **Last updated:** [April 23, 2019, 12:38pm UTC](https://discuss.elastic.co/t/error-while-executing-query-for-loading-lookup-data-in-jdbc-static-plug-in/177902 "2019-04-23T12:38:34Z")
I installed jdbc static plug-in but getting following error: Java::JavaSql::SQLException: Incorrect syntax near 'LIMIT' but my query does not contain LIMIT word. Mine is a simple query like this: SELECT col1,col2,col3 … --- ## [Unable to process log file using logstash](https://discuss.elastic.co/t/unable-to-process-log-file-using-logstash/177992)
**Author:** [@sunilkumar](https://discuss.elastic.co/u/sunilkumar)\ **Replies:** 6\ **Last updated:** [April 23, 2019, 12:21pm UTC](https://discuss.elastic.co/t/unable-to-process-log-file-using-logstash/177992 "2019-04-23T12:21:16Z")
This is a sample of my log file wlapp@ieo2wlzsoat09$ soalogs wlapp@ieo2wlzsoat09$ grep a231326a System.log \ **Author:** [@LI\_Bohao](https://discuss.elastic.co/u/LI_Bohao)\ **Replies:** 6\ **Last updated:** [April 23, 2019, 12:17pm UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591 "2019-04-23T12:17:48Z") I have a Spring Boot application that can emits logs like this (java stacktrace) 2019-04-19 09:10:45.757 ERROR \[discovery,,,\] 1 --- \[tbeatExecutor-0\] com.netflix.discovery.DiscoveryClient : DiscoveryClient\_DISCOVERY/… --- ## [Hit\_cache\_size,hit\_cache\_ttl not working](https://discuss.elastic.co/t/hit-cache-size-hit-cache-ttl-not-working/178026)
**Author:** [@Smack\_Alpha](https://discuss.elastic.co/u/Smack_Alpha)\ **Replies:** 1\ **Last updated:** [April 23, 2019, 12:07pm UTC](https://discuss.elastic.co/t/hit-cache-size-hit-cache-ttl-not-working/178026 "2019-04-23T12:07:39Z")
I am using dns filter in logstash for my csv file. in my csv file, i have two fields. they are website and count. Here's the sample content of my csv file: |website|n| |www.google.com|n1| |www.yahoo.com|n2| |www.bi… --- ## [Join data for events](https://discuss.elastic.co/t/join-data-for-events/177979)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 1\ **Last updated:** [April 23, 2019, 11:28am UTC](https://discuss.elastic.co/t/join-data-for-events/177979 "2019-04-23T11:28:33Z")
Dear All, I want to get query view for filename against the username . filename comes from event2 and username comes from event1 for both events pid common. Event 1 fields =\> timestamp pid username Event 2 fields =\> … --- ## [How to carry parameters in logstash es script](https://discuss.elastic.co/t/how-to-carry-parameters-in-logstash-es-script/178021)
**Author:** [@xingzhi\_Zhang](https://discuss.elastic.co/u/xingzhi_Zhang)\ **Replies:** 0\ **Last updated:** [April 23, 2019, 11:26am UTC](https://discuss.elastic.co/t/how-to-carry-parameters-in-logstash-es-script/178021 "2019-04-23T11:26:18Z")
eg. { "script": { "source": "if (ctx.\_source.supplier.contains(params.supplier)) { ctx.\_source.supplier.remove(ctx.\_source.supplier.indexOfparams.supplier) ;ctx.\_source.supplier.add(params.supplier) }", "lang": "pain… --- ## [Logstash YML config, how it works?](https://discuss.elastic.co/t/logstash-yml-config-how-it-works/178014)
**Author:** [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Replies:** 0\ **Last updated:** [April 23, 2019, 10:59am UTC](https://discuss.elastic.co/t/logstash-yml-config-how-it-works/178014 "2019-04-23T10:59:54Z")
Hey guys, Im newbie with ELK stack but i have some questions. I want to understand how does logstash works. I have a configuration inside conf.d for all my win servers. The clients of elk are win server that has winlog… --- ## [Variable fields in Logstash's Grok-Pattern](https://discuss.elastic.co/t/variable-fields-in-logstashs-grok-pattern/177296)
**Author:** [@Nabil\_Mohamed](https://discuss.elastic.co/u/Nabil_Mohamed)\ **Replies:** 10\ **Last updated:** [April 23, 2019, 10:14am UTC](https://discuss.elastic.co/t/variable-fields-in-logstashs-grok-pattern/177296 "2019-04-23T10:14:46Z")
Dears , kindly i need some help for the below issue --\> -In the RAW data file that i am using in filebeat , has variable # of fields , and i need to build the Grok Pattern in logstash. raw data --\> 001:2019-04-17 00:… --- ## [Which Filter to use](https://discuss.elastic.co/t/which-filter-to-use/177191)
**Author:** [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\ **Replies:** 4\ **Last updated:** [April 23, 2019, 10:13am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191 "2019-04-23T10:13:11Z")
My log is something like below {@timestamp} some text here key1=value1 key2=value2 key3=value3 I have tried json filter as below and got parsing errors. Which filter should I choose here ? I want to push all key value… --- ## [Kafka input](https://discuss.elastic.co/t/kafka-input/177998)
**Author:** [@Masdi](https://discuss.elastic.co/u/Masdi)\ **Replies:** 0\ **Last updated:** [April 23, 2019, 9:39am UTC](https://discuss.elastic.co/t/kafka-input/177998 "2019-04-23T09:39:39Z")
Hi, I have configured an ELK pipeline and setup kafka as an input in my logstash configuration: input { kafka { bootstrap\_servers =\> "127.0.0.1:9092" topics =\> "applog" } } filter { grok { match =\> { "message"… --- ## [Logstash 6.6.2 java execution | AIX](https://discuss.elastic.co/t/logstash-6-6-2-java-execution-aix/177953)
**Author:** [@sl1729](https://discuss.elastic.co/u/sl1729)\ **Replies:** 1\ **Last updated:** [April 23, 2019, 8:32am UTC](https://discuss.elastic.co/t/logstash-6-6-2-java-execution-aix/177953 "2019-04-23T08:32:26Z")
Hello Team, We have setup a ELK cluster in RHEL based machine but we have some apps running in AIX machine where I am trying to setup logstash 6.6.2 to monitor those. But when i try to bring up logstash it starts and c… --- ## [Logstash parsing issue \\\\xC3\\" from ASCII-8BIT to UTF-8](https://discuss.elastic.co/t/logstash-parsing-issue-xc3-from-ascii-8bit-to-utf-8/177959)
**Author:** [@kunal\_p](https://discuss.elastic.co/u/kunal_p)\ **Replies:** 0\ **Last updated:** [April 23, 2019, 7:25am UTC](https://discuss.elastic.co/t/logstash-parsing-issue-xc3-from-ascii-8bit-to-utf-8/177959 "2019-04-23T07:25:38Z")
Hi All, We are parsing the data from Database columns using jbdc plugin in logstash , but for some of the records in the database it is showing below error in the log files. scratching my head to solve this. ========… --- ## [Creating index pattern](https://discuss.elastic.co/t/creating-index-pattern/177001)
**Author:** [@Kalyan\_MB](https://discuss.elastic.co/u/Kalyan_MB)\ **Replies:** 2\ **Last updated:** [April 17, 2019, 2:24pm UTC](https://discuss.elastic.co/t/creating-index-pattern/177001 "2019-04-17T14:24:01Z")
Hi, i have the log format as below, log file: pid: 1131 start: 0 stacksize: 0 breaksize: 9 command: tuned arguments: /usr/bin/python -Es /usr/sbin/tuned -l -P pid: 1163 start: 0 stacksize: 0 breaksize: 11 command: red… --- ## [Could not index event to Elasticsearch 400](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-400/177459)
**Author:** [@nandha\_88](https://discuss.elastic.co/u/nandha_88)\ **Replies:** 2\ **Last updated:** [April 23, 2019, 4:40am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-400/177459 "2019-04-23T04:40:00Z")
Hi All, I have updated the filebeat and elk stack from 6.2.4 to 6.6.1 and ended up with the below error message in the logstash log. "\[2019-04-18T17:24:04,887\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index eve… --- ## [Automatically update index template in Logstash](https://discuss.elastic.co/t/automatically-update-index-template-in-logstash/177923)
**Author:** [@bbking](https://discuss.elastic.co/u/bbking)\ **Replies:** 0\ **Last updated:** [April 23, 2019, 2:14am UTC](https://discuss.elastic.co/t/automatically-update-index-template-in-logstash/177923 "2019-04-23T02:14:50Z")
Hello! I added new fields in an index template file and set template\_overwrite =\> true, but Logstash didn't update the new template and shows mapping error. Is there a way to update an index template directly by Logstash… --- ## [Double convert timezone when parse datetime from sql](https://discuss.elastic.co/t/double-convert-timezone-when-parse-datetime-from-sql/177646)
**Author:** [@4e1e44b5126c14a3c514](https://discuss.elastic.co/u/4e1e44b5126c14a3c514)\ **Replies:** 3\ **Last updated:** [April 22, 2019, 7:43am UTC](https://discuss.elastic.co/t/double-convert-timezone-when-parse-datetime-from-sql/177646 "2019-04-22T07:43:16Z")
I have a table with such columns: |utcDateTime|hash|Type|tran|Code| |2019-04-19 14:53:36.000|d893b735ed52413d9b3ac2109961463f|NULL|NULL|NULL| When I filter them through logstash with jdbc {} input plugin, the first col… --- ## [Logstash 7 GROK Filter plugin 'break\_on\_match' appears to be broken](https://discuss.elastic.co/t/logstash-7-grok-filter-plugin-break-on-match-appears-to-be-broken/176578)
**Author:** [@paul\_nzl](https://discuss.elastic.co/u/paul_nzl)\ **Replies:** 13\ **Last updated:** [April 22, 2019, 9:52pm UTC](https://discuss.elastic.co/t/logstash-7-grok-filter-plugin-break-on-match-appears-to-be-broken/176578 "2019-04-22T21:52:57Z")
Hi, We have just installed v7 of Logstash and ElasticSearch. Our configuration worked fine in 6.7 of both. What we have noticed is that under 7.0 the 'break\_on\_match' option does not appear to be honoured anymore. An… --- ## [Logstash crashes with "comparison of String with 0 failed"](https://discuss.elastic.co/t/logstash-crashes-with-comparison-of-string-with-0-failed/176516)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 2\ **Last updated:** [April 22, 2019, 8:14pm UTC](https://discuss.elastic.co/t/logstash-crashes-with-comparison-of-string-with-0-failed/176516 "2019-04-22T20:14:47Z")
OK, previous problem solved. New problem found. I have the following in my conf file: if \[VirtualHost\] =~ /^\\d+\\.\\d+\\.\\d+\\.\\d+$/ { mutate { add\_tag =\> \["NakedIP"\] … --- ## [Not Creating index](https://discuss.elastic.co/t/not-creating-index/177316)
**Author:** [@jbro](https://discuss.elastic.co/u/jbro)\ **Replies:** 4\ **Last updated:** [April 22, 2019, 7:28pm UTC](https://discuss.elastic.co/t/not-creating-index/177316 "2019-04-22T19:28:17Z")
I am currently working on a windows 2016, elastic / kibana / logstash 6.5.4 I keep getting this but no errors: logstash.instrument.periodicpoller.cgroup\] One or more required cgroup files or directories not found: /pro… --- ## [Using Ruby to count the number of fields in a message, then apply CSV depending on the count?](https://discuss.elastic.co/t/using-ruby-to-count-the-number-of-fields-in-a-message-then-apply-csv-depending-on-the-count/177880)
**Author:** [@sdberts](https://discuss.elastic.co/u/sdberts)\ **Replies:** 1\ **Last updated:** [April 22, 2019, 4:48pm UTC](https://discuss.elastic.co/t/using-ruby-to-count-the-number-of-fields-in-a-message-then-apply-csv-depending-on-the-count/177880 "2019-04-22T16:48:53Z")
I have logs coming from dozens of servers, and two different appliance versions, both of which are in comma-separated format. In one version, there are 73 fields; in the other, there are 93 fields. I need to be able to… --- ## [Directly install logstash output plug in from latest\_specs.4.8.gz copied from rubygems.org?](https://discuss.elastic.co/t/directly-install-logstash-output-plug-in-from-latest-specs-4-8-gz-copied-from-rubygems-org/177878)
**Author:** [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)\ **Replies:** 0\ **Last updated:** [April 22, 2019, 4:03pm UTC](https://discuss.elastic.co/t/directly-install-logstash-output-plug-in-from-latest-specs-4-8-gz-copied-from-rubygems-org/177878 "2019-04-22T16:03:56Z")
I am getting stuck with an error when I try to install the logstash-output-exec plugin when I run: ./bin/logstash-plugin install logstash-ouput-exec I have copied latest\_specs.4.8.gz from rubygems.org. Is there some w… --- ## [Create a new Field based on delimiter](https://discuss.elastic.co/t/create-a-new-field-based-on-delimiter/177863)
**Author:** [@pro](https://discuss.elastic.co/u/pro)\ **Replies:** 0\ **Last updated:** [April 22, 2019, 2:09pm UTC](https://discuss.elastic.co/t/create-a-new-field-based-on-delimiter/177863 "2019-04-22T14:09:22Z")
HI, Im very new to ELK. I have a log like this Message-Id: 34b89892.AMMAADZy0R0AAAAAAAAAAGzbDQ4AAPbYwAAAAAAAUmKABcugLi@gmail.com MIME-Version: 1.0 From: hasdgs@gmail.com Reply-To: hasdgs@gmail.com To: dswifka@yaho… --- ## [Attempting to download logstash plugin - "Connection refused" error - is returned](https://discuss.elastic.co/t/attempting-to-download-logstash-plugin-connection-refused-error-is-returned/177852)
**Author:** [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)\ **Replies:** 0\ **Last updated:** [April 22, 2019, 1:15pm UTC](https://discuss.elastic.co/t/attempting-to-download-logstash-plugin-connection-refused-error-is-returned/177852 "2019-04-22T13:15:15Z")
After setting the following environment variables: http\_proxy and https\_proxy to http://localhost:3128 , I attempted to download the exec output plugin by typing: ./bin/logstash-plugin install logstash-output-exec I re… --- ## [Logstash aborts with warning - pass JVM parameters via LS\_JAVA\_OPTS..Version - 7.0.0](https://discuss.elastic.co/t/logstash-aborts-with-warning-pass-jvm-parameters-via-ls-java-opts-version-7-0-0/177271)
**Author:** [@ItzChandru](https://discuss.elastic.co/u/ItzChandru)\ **Replies:** 4\ **Last updated:** [April 22, 2019, 1:09pm UTC](https://discuss.elastic.co/t/logstash-aborts-with-warning-pass-jvm-parameters-via-ls-java-opts-version-7-0-0/177271 "2019-04-22T13:09:54Z")
C:\\ccstg\\logstash-7.0.0\\bin\>logstash.bat \\IBM\\WebSphere was unexpected at this time. C:\\ccstg\\logstash-7.0.0\\bin\> C:\\ccstg\\logstash-7.0.0\\bin\>logstash.bat warning: ignoring JAVA\_OPTS= -Xms1g -Xmx1g -XX:+UseConcMarkSw… --- ## [Netflow module stops conf files](https://discuss.elastic.co/t/netflow-module-stops-conf-files/177826)
**Author:** [@Farhad\_Kocharli](https://discuss.elastic.co/u/Farhad_Kocharli)\ **Replies:** 1\ **Last updated:** [April 22, 2019, 12:58pm UTC](https://discuss.elastic.co/t/netflow-module-stops-conf-files/177826 "2019-04-22T12:58:45Z")
After adding below configuration to logstash.yml for Netflow module, Logstash stops listen ports for files from conf.d directory. modules: - name: netflow var.elasticsearch.hosts: "localhost:9200" var.input.udp.port… --- ## ["Cannot find class org/jruby/Main." - why is this happening?!?](https://discuss.elastic.co/t/cannot-find-class-org-jruby-main-why-is-this-happening/177137)
**Author:** [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)\ **Replies:** 11\ **Last updated:** [April 22, 2019, 12:46pm UTC](https://discuss.elastic.co/t/cannot-find-class-org-jruby-main-why-is-this-happening/177137 "2019-04-22T12:46:09Z")
... when I type ./bin/logstash-plugin list I get in response: Cannot find class org/jruby/Main. Exception in thread "main" java.lang.UnsupportedClassVersionError: org/jruby/Main : Unsupported major.minor version 51.0 … --- ## [Logstash docker image is not getting created for jdk 11 version](https://discuss.elastic.co/t/logstash-docker-image-is-not-getting-created-for-jdk-11-version/177639)
**Author:** [@Ronnie16](https://discuss.elastic.co/u/Ronnie16)\ **Replies:** 1\ **Last updated:** [April 22, 2019, 12:24pm UTC](https://discuss.elastic.co/t/logstash-docker-image-is-not-getting-created-for-jdk-11-version/177639 "2019-04-22T12:24:01Z")
Hi Team, Is logstash supported for jdk 11 ? I'm not able to create logstash docker image due to below error. It fails at \ Running in 5482e305c73… --- ## [Logstash cannot parse JSON file correctly](https://discuss.elastic.co/t/logstash-cannot-parse-json-file-correctly/177842)
**Author:** [@kaitcoa](https://discuss.elastic.co/u/kaitcoa)\ **Replies:** 0\ **Last updated:** [April 22, 2019, 11:57am UTC](https://discuss.elastic.co/t/logstash-cannot-parse-json-file-correctly/177842 "2019-04-22T11:57:22Z")
Hello there team, how are you? I am pretty new to ELK stack, but right now I do have issue with parsing logs. We do have ~15 machines shipping logs over filebeat to our logstash. We are parsing NGINX and self created … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=559) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=561)