# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=563 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 564 --- ## [Using Logstash to get Postfix Logs](https://discuss.elastic.co/t/using-logstash-to-get-postfix-logs/177389)
**Author:** [@matheusribeirogarcia](https://discuss.elastic.co/u/matheusribeirogarcia)\ **Replies:** 3\ **Last updated:** [April 18, 2019, 8:50am UTC](https://discuss.elastic.co/t/using-logstash-to-get-postfix-logs/177389 "2019-04-18T08:50:17Z")
Hello everyone, i've been trying to use Logstash to parse data of Post Fix Logs, but I've had several problems with Docker Containers in this proccess. Now it seems like my containers are up, but i'm still getting some e… --- ## [Netflow module autostart](https://discuss.elastic.co/t/netflow-module-autostart/177404)
**Author:** [@Farhad\_Kocharli](https://discuss.elastic.co/u/Farhad_Kocharli)\ **Replies:** 0\ **Last updated:** [April 18, 2019, 6:51am UTC](https://discuss.elastic.co/t/netflow-module-autostart/177404 "2019-04-18T06:51:49Z")
Hi everybody. I have installed Netflow module and everything works fine when I start it with below command. /usr/share/logstash/bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 -M netflow.var.k… --- ## [Logstash 7 (W7) issue - Input file issue with sincedb: reads file only once](https://discuss.elastic.co/t/logstash-7-w7-issue-input-file-issue-with-sincedb-reads-file-only-once/176571)
**Author:** [@Sackey](https://discuss.elastic.co/u/Sackey)\ **Replies:** 9\ **Last updated:** [April 18, 2019, 6:33am UTC](https://discuss.elastic.co/t/logstash-7-w7-issue-input-file-issue-with-sincedb-reads-file-only-once/176571 "2019-04-18T06:33:53Z")
Good morning, I have a process on my server where is installed Logstash which generates some data files in an output folder. I have configured my conf file so that Logstash 7 collect these data as soon they are publishe… --- ## [My logstash not getting a spesific json files](https://discuss.elastic.co/t/my-logstash-not-getting-a-spesific-json-files/177371)
**Author:** [@moti.mor](https://discuss.elastic.co/u/moti.mor)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 8:19pm UTC](https://discuss.elastic.co/t/my-logstash-not-getting-a-spesific-json-files/177371 "2019-04-17T20:19:59Z")
Hi guys, my log stash not getting a specific json files. for example if i'm sending a file with without lines in the end of the json the i dont see the file. if im edting the json file with VIM and entering a space or… --- ## [Does logstash need a restart when a geoip database is updated?](https://discuss.elastic.co/t/does-logstash-need-a-restart-when-a-geoip-database-is-updated/177368)
**Author:** [@sushmamagesh](https://discuss.elastic.co/u/sushmamagesh)\ **Replies:** 1\ **Last updated:** [April 17, 2019, 8:05pm UTC](https://discuss.elastic.co/t/does-logstash-need-a-restart-when-a-geoip-database-is-updated/177368 "2019-04-17T20:05:36Z")
Does logstash need a restart when a geoip database is updated? There are a lot of questions for same in previous logstash versions. I was wondering if this is still true for logstash 7. Did not find information regardi… --- ## [Parsing Symantec Enterprise Protection (SEPM) Syslog messages in logstash](https://discuss.elastic.co/t/parsing-symantec-enterprise-protection-sepm-syslog-messages-in-logstash/176977)
**Author:** [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Replies:** 7\ **Last updated:** [April 17, 2019, 7:21pm UTC](https://discuss.elastic.co/t/parsing-symantec-enterprise-protection-sepm-syslog-messages-in-logstash/176977 "2019-04-17T19:21:36Z")
SEPM sends syslog messages in batches at a time interval that is user specified. According to our SEP manager, it is not able to send them one at a time. The message field separates each message with the \\r (carriage r… --- ## [Exception in thread "main" java.lang.UnsupportedClassVersionError: org/jruby/Main : Unsupported major.minor version 51.0](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-unsupportedclassversionerror-org-jruby-main-unsupported-major-minor-version-51-0/177364)
**Author:** [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 6:52pm UTC](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-unsupportedclassversionerror-org-jruby-main-unsupported-major-minor-version-51-0/177364 "2019-04-17T18:52:58Z")
Exception in thread "main" java.lang.UnsupportedClassVersionError: org/jruby/Main : Unsupported major.minor version 51.0 Has anyone successfully resolved this error when trying to implement logstash-plugin --- ## [Beat fields and logstash filters](https://discuss.elastic.co/t/beat-fields-and-logstash-filters/177341)
**Author:** [@4rakasi](https://discuss.elastic.co/u/4rakasi)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 4:30pm UTC](https://discuss.elastic.co/t/beat-fields-and-logstash-filters/177341 "2019-04-17T16:30:26Z")
Hello, With the upgrade to version 7.0.0, many fields have been changed for beats agent. My template have been updated regarding those changes, however I have a problem with my logstash filters. I created those filter… --- ## [COMMONAPACHELOG vs Explicit replacement](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318)
**Author:** [@jmota](https://discuss.elastic.co/u/jmota)\ **Replies:** 3\ **Last updated:** [April 17, 2019, 3:41pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318 "2019-04-17T15:41:24Z")
gi, can some1 help with this one ? ( ES 7, LS 7) if i use COMMONAPACHELOG logstash works ... if i replace it for its "long version" gives me an error... ( i only use 1 at a time, cant edit the coments) full pattern… --- ## [Update array of object with jdbc](https://discuss.elastic.co/t/update-array-of-object-with-jdbc/177331)
**Author:** [@Mathieu\_Lussier](https://discuss.elastic.co/u/Mathieu_Lussier)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 3:25pm UTC](https://discuss.elastic.co/t/update-array-of-object-with-jdbc/177331 "2019-04-17T15:25:16Z")
Im facing a problem. Im using jdbc to synchronise elasticsearch with mariadb mysql. Im building a searching system with elasticsearch for my company for the intranet and the ticket. With the actual app we can reply to … --- ## [How to add\_field in index using logstash and output of a search query of same index](https://discuss.elastic.co/t/how-to-add-field-in-index-using-logstash-and-output-of-a-search-query-of-same-index/177326)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 3:01pm UTC](https://discuss.elastic.co/t/how-to-add-field-in-index-using-logstash-and-output-of-a-search-query-of-same-index/177326 "2019-04-17T15:01:05Z")
\*\*I have below data stored in an elasticsearch index { "prospector" =\> { "type" =\> "log" }, "message" =\> "11/1/2018 10:05:00,fabrice,eldo,7,100", "@timestamp" =\> 2019-04-17T05:44:47.133Z, "SITE" =\> "GRENOBLE", "s… --- ## [Grok pattern for Apache customized log](https://discuss.elastic.co/t/grok-pattern-for-apache-customized-log/177270)
**Author:** [@srinivasas](https://discuss.elastic.co/u/srinivasas)\ **Replies:** 3\ **Last updated:** [April 17, 2019, 3:17pm UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-customized-log/177270 "2019-04-17T15:17:15Z")
Hello, we are using a filebeat Apahce module to parse apache access logs and customized the default log format. Logs are sent to Logstash there we want to use the grok filter to catch few events through alerts. We trie… --- ## [Logstash to Cloud Elasticsearch thorugh SSL issue](https://discuss.elastic.co/t/logstash-to-cloud-elasticsearch-thorugh-ssl-issue/177323)
**Author:** [@Lathanaganna](https://discuss.elastic.co/u/Lathanaganna)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 2:53pm UTC](https://discuss.elastic.co/t/logstash-to-cloud-elasticsearch-thorugh-ssl-issue/177323 "2019-04-17T14:53:40Z")
Trying to load data from MySQL to Elasticsearch over IBM cloud using Logstash. This is secured service, need to use SSL. following is the elasticsearch setting i am providing in logstash config. It is giving error as No … --- ## [XML PARSED](https://discuss.elastic.co/t/xml-parsed/176903)
**Author:** [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\ **Replies:** 13\ **Last updated:** [April 17, 2019, 2:21pm UTC](https://discuss.elastic.co/t/xml-parsed/176903 "2019-04-17T14:21:39Z")
\#ISSUE LOGSTASH PARSE XML Hi, I've a problem parsing xml response from API (http\_poller). I receive a weird xml response and idk how I can parse it. My file.conf is this: The API response is(postman image): I want… --- ## [Handling epoch timestamps in logstash filter](https://discuss.elastic.co/t/handling-epoch-timestamps-in-logstash-filter/176976)
**Author:** [@dips](https://discuss.elastic.co/u/dips)\ **Replies:** 3\ **Last updated:** [April 17, 2019, 2:08pm UTC](https://discuss.elastic.co/t/handling-epoch-timestamps-in-logstash-filter/176976 "2019-04-17T14:08:24Z")
Hello, I need help to convert epoch timestamp to regular date time stamp. But this epoch timestamp (CrashTime) exists in the header of the log file under metadata section. I am storing all these metadata values in @@Met… --- ## [Logstash infinitely using all CPUs but not producing output/errors](https://discuss.elastic.co/t/logstash-infinitely-using-all-cpus-but-not-producing-output-errors/177299)
**Author:** [@usrjph](https://discuss.elastic.co/u/usrjph)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 1:28pm UTC](https://discuss.elastic.co/t/logstash-infinitely-using-all-cpus-but-not-producing-output-errors/177299 "2019-04-17T13:28:33Z")
Unfortunately I'm unsure if an upgrade or a filter modification caused this but Logstash is unable to bulk ingest a set of log files. This set has been bulk ingested many times previously, now Logstash just appears to st… --- ## [Logstash WMI Plugin error](https://discuss.elastic.co/t/logstash-wmi-plugin-error/177297)
**Author:** [@nyarlath](https://discuss.elastic.co/u/nyarlath)\ **Replies:** 0\ **Last updated:** [April 17, 2019, 1:24pm UTC](https://discuss.elastic.co/t/logstash-wmi-plugin-error/177297 "2019-04-17T13:24:00Z")
Hello, I have Logstash installed on a RHEL. I Installed the WMI plugin (logstash-input-wmi) and tried to run it. I am facing the following issue : \[ERROR\] 2019-04-17 12:43:07.765 \[Converge PipelineAction::Create\\]… --- ## [Multiple pipelines configurations not processed in Docker container](https://discuss.elastic.co/t/multiple-pipelines-configurations-not-processed-in-docker-container/177258)
**Author:** [@nufje](https://discuss.elastic.co/u/nufje)\ **Replies:** 2\ **Last updated:** [April 17, 2019, 1:21pm UTC](https://discuss.elastic.co/t/multiple-pipelines-configurations-not-processed-in-docker-container/177258 "2019-04-17T13:21:22Z")
Hello, According Configuring Logstash for Docker | Logstash Reference \[6.4\] | Elastic i'am using multiple conf files in /usr/share/logstash/pipelines My first question is: Do i understand correct that i can use multipl… --- ## [Logstash restart loop](https://discuss.elastic.co/t/logstash-restart-loop/177163)
**Author:** [@johndowe](https://discuss.elastic.co/u/johndowe)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 10:32pm UTC](https://discuss.elastic.co/t/logstash-restart-loop/177163 "2019-04-16T22:32:11Z")
I have setup Filebeats succesfully and noticed logstash is still not processing any logs since it is continuously restarting. This is what I am seeing in the log files on the Raspberry Pi : \[2019-04-17T00:25:17,025\]\[ER… --- ## [Arithmetic Operations in logstash](https://discuss.elastic.co/t/arithmetic-operations-in-logstash/177183)
**Author:** [@dinesh1](https://discuss.elastic.co/u/dinesh1)\ **Replies:** 1\ **Last updated:** [April 17, 2019, 12:57pm UTC](https://discuss.elastic.co/t/arithmetic-operations-in-logstash/177183 "2019-04-17T12:57:39Z")
Hi Team, How to perform arithmetic Operations in logstash Example: (((field1)+((($field2)-(field1))/2))/300) Thanks, Dinesh --- ## [Translate filter not mapping output](https://discuss.elastic.co/t/translate-filter-not-mapping-output/177277)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 2\ **Last updated:** [April 17, 2019, 12:56pm UTC](https://discuss.elastic.co/t/translate-filter-not-mapping-output/177277 "2019-04-17T12:56:13Z")
I have following test.conf file of logstash input { stdin { codec =\> json } } filter { translate { field =\> "user" destination =\> "division" dictionary\_path =\> './PA\_orga1\_div.yml' add\_field =\> \[ "div", "%{div… --- ## [Logstash don't send to Elastcisearch when i use %{WORD:service} in grok](https://discuss.elastic.co/t/logstash-dont-send-to-elastcisearch-when-i-use-word-service-in-grok/177189)
**Author:** [@fabueno](https://discuss.elastic.co/u/fabueno)\ **Replies:** 1\ **Last updated:** [April 17, 2019, 12:53pm UTC](https://discuss.elastic.co/t/logstash-dont-send-to-elastcisearch-when-i-use-word-service-in-grok/177189 "2019-04-17T12:53:18Z")
Hi, I'm just "training" with grok pattern, and with this log file : Apr 17 14:26:49 192.168.0.61 firewall 514865 11:12:13:14:15:16 abcd123|-=.\> If I do : grok { match =\> { \["message", "%{SYSLOGTIMESTAMP:date} %{IP:ip}"… --- ## [Extract only the variables from parentheses but the location is not the same](https://discuss.elastic.co/t/extract-only-the-variables-from-parentheses-but-the-location-is-not-the-same/177203)
**Author:** [@SilviuSS](https://discuss.elastic.co/u/SilviuSS)\ **Replies:** 1\ **Last updated:** [April 17, 2019, 12:50pm UTC](https://discuss.elastic.co/t/extract-only-the-variables-from-parentheses-but-the-location-is-not-the-same/177203 "2019-04-17T12:50:00Z")
i have a problem when I want to extract a variables from parentheses. my example : transactionIdentifier=0/0(016)0009/019953 from that information i need to create a new field and contain just the information that exis… --- ## [Logstash parse three numbers](https://discuss.elastic.co/t/logstash-parse-three-numbers/177279)
**Author:** [@sana1](https://discuss.elastic.co/u/sana1)\ **Replies:** 1\ **Last updated:** [April 17, 2019, 12:22pm UTC](https://discuss.elastic.co/t/logstash-parse-three-numbers/177279 "2019-04-17T12:22:43Z")
I have a log file with three numbers with variable spaces 2345 6678x2 8900000 I want to add them as three fields name Field 1, Field 2 and Field 3 Field 1: 2345 Field 2 : 6678x2 Field 3 : 8900000 please tell me a… --- ## [How to collect logs using logstash in ubuntu?](https://discuss.elastic.co/t/how-to-collect-logs-using-logstash-in-ubuntu/177169)
**Author:** [@farida](https://discuss.elastic.co/u/farida)\ **Replies:** 2\ **Last updated:** [April 17, 2019, 11:04am UTC](https://discuss.elastic.co/t/how-to-collect-logs-using-logstash-in-ubuntu/177169 "2019-04-17T11:04:06Z")
I had installed ELK in a VM machine (Ubuntu) but i don't know how i recover logs file with logstash. --- ## [Autodetect\_column\_names is not working as expected in csv filter pluing](https://discuss.elastic.co/t/autodetect-column-names-is-not-working-as-expected-in-csv-filter-pluing/177161)
**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\ **Replies:** 2\ **Last updated:** [April 17, 2019, 10:44am UTC](https://discuss.elastic.co/t/autodetect-column-names-is-not-working-as-expected-in-csv-filter-pluing/177161 "2019-04-17T10:44:14Z")
HI Team, I'm trying to parse csv files with few rows and trying to auto detect the column names but its not working as expected for example input temp.csv name,compan,emp,abc,address ro han,,,be,myadd a b c,234,3 c… --- ## [Error logstash.inputs.jdbc Unable to connect to database](https://discuss.elastic.co/t/error-logstash-inputs-jdbc-unable-to-connect-to-database/177091)
**Author:** [@medaly\_ahmed](https://discuss.elastic.co/u/medaly_ahmed)\ **Replies:** 4\ **Last updated:** [April 17, 2019, 10:03am UTC](https://discuss.elastic.co/t/error-logstash-inputs-jdbc-unable-to-connect-to-database/177091 "2019-04-17T10:03:16Z")
I am a beginner in logstash. I want to load my database "mydb" in the inddex "test". but I find an error with logstash: "error logstash.inputs.jdbc Unable to connect to database" this is my config file: \`input { … --- ## [Create multiple indexes with single logstash configuration file depending upon the kafka channel](https://discuss.elastic.co/t/create-multiple-indexes-with-single-logstash-configuration-file-depending-upon-the-kafka-channel/177003)
**Author:** [@Nandita\_Rane](https://discuss.elastic.co/u/Nandita_Rane)\ **Replies:** 4\ **Last updated:** [April 17, 2019, 5:59am UTC](https://discuss.elastic.co/t/create-multiple-indexes-with-single-logstash-configuration-file-depending-upon-the-kafka-channel/177003 "2019-04-17T05:59:13Z")
Please help me to resolve this issue. Issue Description: I want to create a logstash configuration which will put logs in two different index. I tried with this configuration but not able to create index in logstash. p… --- ## [Wrong indexes with syslog](https://discuss.elastic.co/t/wrong-indexes-with-syslog/176899)
**Author:** [@Farhad\_Kocharli](https://discuss.elastic.co/u/Farhad_Kocharli)\ **Replies:** 7\ **Last updated:** [April 17, 2019, 5:08am UTC](https://discuss.elastic.co/t/wrong-indexes-with-syslog/176899 "2019-04-17T05:08:16Z")
I have configured Logstash (see below configuration) to get logs from Cisco devices with syslog. Despite I have configured in "output" section index (index =\> "network-%{+YYYY.MM.dd}") on Kibana side I see wron… --- ## [Dropping Events in between Start Event & End Event](https://discuss.elastic.co/t/dropping-events-in-between-start-event-end-event/176168)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 4\ **Last updated:** [April 17, 2019, 4:35am UTC](https://discuss.elastic.co/t/dropping-events-in-between-start-event-end-event/176168 "2019-04-17T04:35:23Z")
Hi, My setup : Logstash/Elasticsearch/Kibana 6.4.3 These are the sample logs that are recorded from a source. Where alarmstate: 0 means Alarm open & alarmstate:1 means Alarm closed alarm: id1 alarmstate: 0 deviceID… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=562) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=564)