# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=564 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 565 --- ## [Logstash to Database compatibility](https://discuss.elastic.co/t/logstash-to-database-compatibility/177180)
**Author:** [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\ **Replies:** 2\ **Last updated:** [April 17, 2019, 4:38am UTC](https://discuss.elastic.co/t/logstash-to-database-compatibility/177180 "2019-04-17T04:38:12Z")
Can logstash connect to any kind of database like Oracle, My SQL, SQL, MongoDB etc... Or Are there any restrictions on open source vs premium related to database connectivity ? --- ## [Date format changes automatically after adding 3600 to dateOptionalTime field](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166)
**Author:** [@manishash](https://discuss.elastic.co/u/manishash)\ **Replies:** 3\ **Last updated:** [April 17, 2019, 2:39am UTC](https://discuss.elastic.co/t/date-format-changes-automatically-after-adding-3600-to-dateoptionaltime-field/177166 "2019-04-17T02:39:00Z")
I am using 2.3 version. I know very old but i do got to fix the data. In a timestamp field which is referenced by got timestamp as of UTC I have to add 1 hour to the dateOptionalTime field in 1 index. logstash conf … --- ## [Logstash won't parse CSV to elasticsearch](https://discuss.elastic.co/t/logstash-wont-parse-csv-to-elasticsearch/177156)
**Author:** [@Ac3](https://discuss.elastic.co/u/Ac3)\ **Replies:** 2\ **Last updated:** [April 16, 2019, 10:27pm UTC](https://discuss.elastic.co/t/logstash-wont-parse-csv-to-elasticsearch/177156 "2019-04-16T22:27:19Z")
I'm trying to parse a CSV file using Logstash to ElasticSearch. The index cannot be found in Kibana, and Logstash claims the config file is 'ok'. I bet the problem is obvious, I just can't see it. Can anyone help me deb… --- ## [Unable to get logstash-input-jmx working](https://discuss.elastic.co/t/unable-to-get-logstash-input-jmx-working/177160)
**Author:** [@madelaney](https://discuss.elastic.co/u/madelaney)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 10:08pm UTC](https://discuss.elastic.co/t/unable-to-get-logstash-input-jmx-working/177160 "2019-04-16T22:08:09Z")
While trying to configure the logstash-input-jmx plugin, I've hit a brick wall where I can't seem to find why an exception is getting raise. The error that I'm getting is this: Apr 16 18:03:07 elk logstash\[15125\]: \[201… --- ## [Multiline JSON file not ingested with logstash to ElasticSearch](https://discuss.elastic.co/t/multiline-json-file-not-ingested-with-logstash-to-elasticsearch/177144)
**Author:** [@releaseblocker](https://discuss.elastic.co/u/releaseblocker)\ **Replies:** 1\ **Last updated:** [April 16, 2019, 8:03pm UTC](https://discuss.elastic.co/t/multiline-json-file-not-ingested-with-logstash-to-elasticsearch/177144 "2019-04-16T20:03:49Z")
I have a logstash config file as input{ file { type =\> "json" path =\> "/home/$user/MOCK\_DATA.json" start\_position =\> "beginning" codec =\> multiline { pattern =\> '^{' what =\> previous } } } output{ elasticse… --- ## [Are Logstash conf files combined in some way?](https://discuss.elastic.co/t/are-logstash-conf-files-combined-in-some-way/176970)
**Author:** [@pmarques](https://discuss.elastic.co/u/pmarques)\ **Replies:** 4\ **Last updated:** [April 16, 2019, 4:41pm UTC](https://discuss.elastic.co/t/are-logstash-conf-files-combined-in-some-way/176970 "2019-04-16T16:41:23Z")
Hello All, I might miss some information on the documentation... I saved two different configuration files at /etc/logstash/conf.d which may run under 'main' pipeline first.conf input { file { path =\> … --- ## [Multiple Outputs In Logstash](https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 2\ **Last updated:** [April 16, 2019, 3:36pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111 "2019-04-16T15:36:02Z")
Hi all, Is it possible to have a conditional output in logstash? My setup is several different filters in /etc/logstash/conf.d with grok filters. They all then look at my output.conf file. In my output.conf file I se… --- ## [Problem to install logstash using 'sudo apt install logstash'](https://discuss.elastic.co/t/problem-to-install-logstash-using-sudo-apt-install-logstash/177029)
**Author:** [@alextim](https://discuss.elastic.co/u/alextim)\ **Replies:** 2\ **Last updated:** [April 16, 2019, 3:24pm UTC](https://discuss.elastic.co/t/problem-to-install-logstash-using-sudo-apt-install-logstash/177029 "2019-04-16T15:24:04Z")
Hi everyone. I trying to install logstash (sudo apt install logstash) on my laptop with ubuntu 18.04 and having following outcome: Setting up logstash (1:6.7.1-1) ... Using provided startup.options file: /etc/logstash… --- ## [Get year, month and date when not specified on log](https://discuss.elastic.co/t/get-year-month-and-date-when-not-specified-on-log/174195)
**Author:** [@pbressan13](https://discuss.elastic.co/u/pbressan13)\ **Replies:** 1\ **Last updated:** [April 16, 2019, 2:49pm UTC](https://discuss.elastic.co/t/get-year-month-and-date-when-not-specified-on-log/174195 "2019-04-16T14:49:23Z")
Hi, I'm facing with a particular issue, I'm trying to find the best and accurate way to set year/month/day to my input document My input log only prints hour:minute:second, like example above: 16:00:00,840 blablabla..… --- ## [Another Logstash Json Filter](https://discuss.elastic.co/t/another-logstash-json-filter/176586)
**Author:** [@Mrde](https://discuss.elastic.co/u/Mrde)\ **Replies:** 9\ **Last updated:** [April 16, 2019, 2:39pm UTC](https://discuss.elastic.co/t/another-logstash-json-filter/176586 "2019-04-16T14:39:58Z")
Hello, Sorry to add another topic on this subject but even by reading many posts about this, i didn't succeed to solve my issue : Time to learn from community :slight\_smile: Here is an exemple of json input that i don'… --- ## [Renaming Nested Objects](https://discuss.elastic.co/t/renaming-nested-objects/176885)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [April 16, 2019, 2:32pm UTC](https://discuss.elastic.co/t/renaming-nested-objects/176885 "2019-04-16T14:32:25Z")
Hi, If I have a field that is a dict-like object such as \`\[field\_1\]\[field\_2\]\[field\_3\]' how can I rename 'field\_1' while leaving the sub-fields unchanged? I have tried: filter { mutate { rename =\> { "\[field\_1… --- ## [Problem with logstash-plugin](https://discuss.elastic.co/t/problem-with-logstash-plugin/177103)
**Author:** [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)\ **Replies:** 1\ **Last updated:** [April 16, 2019, 2:14pm UTC](https://discuss.elastic.co/t/problem-with-logstash-plugin/177103 "2019-04-16T14:14:17Z")
I am running elasticsearch 6.6.0 and am trying to install the exec output plugin. The attempts and results are shown below: --- ## [Unable to get batch command to run in logstash output exec](https://discuss.elastic.co/t/unable-to-get-batch-command-to-run-in-logstash-output-exec/176949)
**Author:** [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)\ **Replies:** 6\ **Last updated:** [April 16, 2019, 1:08pm UTC](https://discuss.elastic.co/t/unable-to-get-batch-command-to-run-in-logstash-output-exec/176949 "2019-04-16T13:08:40Z")
I have a batch file in .../logstash/bin that looks like this: copy c:\\LogsIndexService\\BackupXX\\IndexInitializer.log c:\\LogsIndexService I am trying to run it from a pipeline output section as follows output { exec … --- ## [Mutate gsub json with backslash](https://discuss.elastic.co/t/mutate-gsub-json-with-backslash/176981)
**Author:** [@stash2logs](https://discuss.elastic.co/u/stash2logs)\ **Replies:** 5\ **Last updated:** [April 16, 2019, 12:30pm UTC](https://discuss.elastic.co/t/mutate-gsub-json-with-backslash/176981 "2019-04-16T12:30:06Z")
{\\n"protocol":"HTTP/1.1",\\n"remote\_addr":"127.0.0.1"} I have the follwing json message and I'm looking to use the mutate gsub filter to do two things: 1 - remove the \\n 2 - remove the \\ (backslashes) Ideally i would … --- ## [Building an index with multiple tables in Logstash 7.0](https://discuss.elastic.co/t/building-an-index-with-multiple-tables-in-logstash-7-0/176909)
**Author:** [@Pablo\_S](https://discuss.elastic.co/u/Pablo_S)\ **Replies:** 0\ **Last updated:** [April 15, 2019, 1:09pm UTC](https://discuss.elastic.co/t/building-an-index-with-multiple-tables-in-logstash-7-0/176909 "2019-04-15T13:09:26Z")
I have 20 tables in Oracle, all of them contain (among others) the following columns: id, name, description and notes. I would like the user to enter a text, the text to be searched in either name, description and/or not… --- ## [How can Filebeat specify match rules to Logstash](https://discuss.elastic.co/t/how-can-filebeat-specify-match-rules-to-logstash/176818)
**Author:** [@Gary.Pan](https://discuss.elastic.co/u/Gary.Pan)\ **Replies:** 5\ **Last updated:** [April 16, 2019, 12:20pm UTC](https://discuss.elastic.co/t/how-can-filebeat-specify-match-rules-to-logstash/176818 "2019-04-16T12:20:58Z")
I want to let Logstash'gork filter use the match rules which Filebeat give Here is my Filebeat config: filebeat.inputs: - type: log enabled: true paths: - /root/Log-test/test.log fields: "@metadata": … --- ## [Multiple log in input, how to filter one by one?](https://discuss.elastic.co/t/multiple-log-in-input-how-to-filter-one-by-one/176882)
**Author:** [@fabueno](https://discuss.elastic.co/u/fabueno)\ **Replies:** 3\ **Last updated:** [April 16, 2019, 12:01pm UTC](https://discuss.elastic.co/t/multiple-log-in-input-how-to-filter-one-by-one/176882 "2019-04-16T12:01:35Z")
Hi, Im a beginner with ELK and I want to apply different filter on my log. This is my input file : input { beats { type =\> log port =\> 5044 host =\> 0.0.0.0 } } With this file, we listen on port 5044, from everyw… --- ## [Getting error in Logstash grok filter for rds slow query](https://discuss.elastic.co/t/getting-error-in-logstash-grok-filter-for-rds-slow-query/176878)
**Author:** [@Rajat\_Ravi](https://discuss.elastic.co/u/Rajat_Ravi)\ **Replies:** 8\ **Last updated:** [April 16, 2019, 11:47am UTC](https://discuss.elastic.co/t/getting-error-in-logstash-grok-filter-for-rds-slow-query/176878 "2019-04-16T11:47:40Z")
Hi Team Below are the error that I am getting Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"#\ **Author:** [@jagadeeshkoka](https://discuss.elastic.co/u/jagadeeshkoka)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 9:31am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kiabana-or-eleastic-search/177043 "2019-04-16T09:31:45Z") how to make sure logstash is actually sending data to elastic search, after following a getting start guide filebeat-\>logstash-\>elasticsearch-\>kiabana Logstash configuration # Sample Logstash configuration for creating… --- ## [Change Logstash template from 3 decimal place to 2](https://discuss.elastic.co/t/change-logstash-template-from-3-decimal-place-to-2/177038)
**Author:** [@ek9boy](https://discuss.elastic.co/u/ek9boy)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 9:01am UTC](https://discuss.elastic.co/t/change-logstash-template-from-3-decimal-place-to-2/177038 "2019-04-16T09:01:56Z")
Hi, I created a logstsh template which chnaged a number value to float. however there anyway to change this to 2 decimal place? --- ## [Problem with multiple pipelines](https://discuss.elastic.co/t/problem-with-multiple-pipelines/177035)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 8:57am UTC](https://discuss.elastic.co/t/problem-with-multiple-pipelines/177035 "2019-04-16T08:57:09Z")
I am trying to import logs from different location from my local machine using logstash simultaneously, I have configured the pipeline.yml as pipeline.id: apachelogs path.config: "/etc/logstash/conf.d/first-pipeline.c… --- ## [Grok Pattern for Multiline log pattern](https://discuss.elastic.co/t/grok-pattern-for-multiline-log-pattern/177007)
**Author:** [@ashishm](https://discuss.elastic.co/u/ashishm)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 6:58am UTC](https://discuss.elastic.co/t/grok-pattern-for-multiline-log-pattern/177007 "2019-04-16T06:58:45Z")
from the below log line, I want to extract java.lang.exception as I need to show count of every exception in my kibana board \[28.03.19 05:44:47:954 MEZ\] 0000085d SystemOut O 28 Mär 2019 05:44:47:953 \[ERROR\] \[Server… --- ## [Help parsing XML-filter processed data with ruby](https://discuss.elastic.co/t/help-parsing-xml-filter-processed-data-with-ruby/176841)
**Author:** [@makibroshett](https://discuss.elastic.co/u/makibroshett)\ **Replies:** 4\ **Last updated:** [April 16, 2019, 6:53am UTC](https://discuss.elastic.co/t/help-parsing-xml-filter-processed-data-with-ruby/176841 "2019-04-16T06:53:42Z")
Hi, I need some help writing seemingly simple ruby code, but I can't figure out how (newbie). At some point, my pipeline produces a field structured as follows:: "xmldata" =\> { "uplinkMessage" =\> { "constrained… --- ## [Logstash output elasticsearch script error](https://discuss.elastic.co/t/logstash-output-elasticsearch-script-error/177004)
**Author:** [@xingzhi\_Zhang](https://discuss.elastic.co/u/xingzhi_Zhang)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 6:17am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-script-error/177004 "2019-04-16T06:17:06Z")
I need to update the local field json in elasticsearch and get an error. My script file output elasticsearch is: script =\>"ctx.\_source.supplier.%{gys}.kcl=params.event.get('message')" error: \[2019-04-16T14:11:53,468\]… --- ## [Reading GC logs using logstash and creating multiple graphs using Kibana](https://discuss.elastic.co/t/reading-gc-logs-using-logstash-and-creating-multiple-graphs-using-kibana/176997)
**Author:** [@Abinaya](https://discuss.elastic.co/u/Abinaya)\ **Replies:** 0\ **Last updated:** [April 16, 2019, 5:16am UTC](https://discuss.elastic.co/t/reading-gc-logs-using-logstash-and-creating-multiple-graphs-using-kibana/176997 "2019-04-16T05:16:12Z")
Hi Team, I am trying to read GC logs and create meaningful graphs from it. Below is the sample GC log am using. I need to write grok for the below one. Please help me with that. GC log pattern 28.931: \[GC28.931: \[ParN… --- ## [Match filter for database table](https://discuss.elastic.co/t/match-filter-for-database-table/176911)
**Author:** [@Pradyumna\_Jha](https://discuss.elastic.co/u/Pradyumna_Jha)\ **Replies:** 3\ **Last updated:** [April 16, 2019, 6:13am UTC](https://discuss.elastic.co/t/match-filter-for-database-table/176911 "2019-04-16T06:13:50Z")
Is there any filter available to match a pattern for database table column? Please help me out. Can we use grok over here? --- ## [Count number of line in message field(multiline message field)](https://discuss.elastic.co/t/count-number-of-line-in-message-field-multiline-message-field/176842)
**Author:** [@Abinaya](https://discuss.elastic.co/u/Abinaya)\ **Replies:** 2\ **Last updated:** [April 16, 2019, 5:10am UTC](https://discuss.elastic.co/t/count-number-of-line-in-message-field-multiline-message-field/176842 "2019-04-16T05:10:58Z")
Hi Team, I am trying to do thread dumb analysis using logstash. I want to read number of line available in the message filed using logstash code and create a pie chart based on line count. Please let me know how to cou… --- ## [Superlong lines are not processed](https://discuss.elastic.co/t/superlong-lines-are-not-processed/176952)
**Author:** [@bartimaeus](https://discuss.elastic.co/u/bartimaeus)\ **Replies:** 2\ **Last updated:** [April 16, 2019, 5:01am UTC](https://discuss.elastic.co/t/superlong-lines-are-not-processed/176952 "2019-04-16T05:01:13Z")
Hi everyone, We have put ELK stack in place for out monitoring and central logging mechanism. We are happy with common apache, nginx log shipping and storing. Also, for some of out services we generate manual logs. In p… --- ## [How can i convert to complex json file](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874)
**Author:** [@newface](https://discuss.elastic.co/u/newface)\ **Replies:** 8\ **Last updated:** [April 16, 2019, 1:38am UTC](https://discuss.elastic.co/t/how-can-i-convert-to-complex-json-file/176874 "2019-04-16T01:38:02Z")
Hello i try a complex json using split plugin But, the result is not my intent. Json file is like this. { "col1" : "0C35C", "col2" : 0, "col3" : "was", "col4" : "AAF", "col5" : "20190329", "col6" : … --- ## [Parsing stringified JSON from filebeat input](https://discuss.elastic.co/t/parsing-stringified-json-from-filebeat-input/176972)
**Author:** [@cheeni](https://discuss.elastic.co/u/cheeni)\ **Replies:** 6\ **Last updated:** [April 16, 2019, 12:53am UTC](https://discuss.elastic.co/t/parsing-stringified-json-from-filebeat-input/176972 "2019-04-16T00:53:17Z")
Greetings, I am a total newbie to Elastic and co, so please educate. I have filebeat set up to export JSON from a log file with lines like this: "08-Apr-2019 01:11:16.047 INFO \[http-nio-443-exec-37\] MyClass.Func MyClass… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=563) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=565)