# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=570 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 571 --- ## [Logstash not recognising .log files](https://discuss.elastic.co/t/logstash-not-recognising-log-files/175744)
**Author:** [@rb6](https://discuss.elastic.co/u/rb6)\ **Replies:** 0\ **Last updated:** [April 8, 2019, 12:57am UTC](https://discuss.elastic.co/t/logstash-not-recognising-log-files/175744 "2019-04-08T00:57:59Z")
Hi, I'm attempting to parse authentication logs using an elk stack, it was all up and running one week. Logstash was able to process all of the logs placed within the directory, both .log and .log.1 files. Then after re… --- ## [Logstash failed to start with error "Logstash stopped processing because of an error: (SystemExit) exit"](https://discuss.elastic.co/t/logstash-failed-to-start-with-error-logstash-stopped-processing-because-of-an-error-systemexit-exit/173884)
**Author:** [@Benjen](https://discuss.elastic.co/u/Benjen)\ **Replies:** 5\ **Last updated:** [April 8, 2019, 2:10am UTC](https://discuss.elastic.co/t/logstash-failed-to-start-with-error-logstash-stopped-processing-because-of-an-error-systemexit-exit/173884 "2019-04-08T02:10:59Z")
I am an amateur to ELK and working on setup the logstash to elasticsearch (on elastic cloud). So ultimately my logs will be shipping from local logstash machine to Elastic Cloud. At some point I was managed to check my l… --- ## ["Attempted to resurrect connection to dead ES instance, but got an error." Error, it worked before. What is wrong now?](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error-error-it-worked-before-what-is-wrong-now/175721)
**Author:** [@Tony\_Pham](https://discuss.elastic.co/u/Tony_Pham)\ **Replies:** 4\ **Last updated:** [April 7, 2019, 10:25pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error-error-it-worked-before-what-is-wrong-now/175721 "2019-04-07T22:25:14Z")
Hello, I know that the device which is host to Logstash can ping to the device which is host to Kibana and Elasticsearch. I once parsed syslog using logstash to elasticsearch. Now I need to parse json file (suricata d… --- ## [SNMP TRAP message forwarding to logstash](https://discuss.elastic.co/t/snmp-trap-message-forwarding-to-logstash/175235)
**Author:** [@SISA\_Nirmal\_kumar\_B](https://discuss.elastic.co/u/SISA_Nirmal_kumar_B)\ **Replies:** 3\ **Last updated:** [April 7, 2019, 10:14pm UTC](https://discuss.elastic.co/t/snmp-trap-message-forwarding-to-logstash/175235 "2019-04-07T22:14:29Z")
Can anyone tell me how to forward snmp trap messages from Windows to logstash snmptrap input plugin --- ## [Ingesting Packetbeat DNS](https://discuss.elastic.co/t/ingesting-packetbeat-dns/175700)
**Author:** [@Great](https://discuss.elastic.co/u/Great)\ **Replies:** 1\ **Last updated:** [April 7, 2019, 10:06pm UTC](https://discuss.elastic.co/t/ingesting-packetbeat-dns/175700 "2019-04-07T22:06:16Z")
can anyone help me with ingesting DNS requesting using packetbeat in logstash . im having the following filter and it keep tilling me client\_ip is missing filter { if "packetbeat" in \[tags\] { dns { reverse =\> \[ "cli… --- ## [LS intermittently shows zero EPS received/emitted](https://discuss.elastic.co/t/ls-intermittently-shows-zero-eps-received-emitted/175727)
**Author:** [@millap](https://discuss.elastic.co/u/millap)\ **Replies:** 2\ **Last updated:** [April 7, 2019, 7:19pm UTC](https://discuss.elastic.co/t/ls-intermittently-shows-zero-eps-received-emitted/175727 "2019-04-07T19:19:21Z")
Hi All, Looking for a little advice in trying to narrow down the source of a problem we have with our ELK instance. Intermittently, we're seeing the received, and emitted EPS on an LS node drop to zero and we can't fig… --- ## [Filter and count indeterminate number of not-known keywords](https://discuss.elastic.co/t/filter-and-count-indeterminate-number-of-not-known-keywords/175705)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 4\ **Last updated:** [April 7, 2019, 4:17pm UTC](https://discuss.elastic.co/t/filter-and-count-indeterminate-number-of-not-known-keywords/175705 "2019-04-07T16:17:00Z")
Hi, Although I saw some posts with similar questions, the answers (at least for the posts I saw), did not apply. So first of all, sorry if I'm duplicating an issue/post. I'm trying to filter and work on some logs. This… --- ## [Logstash for Cloud flare Enterprise Log](https://discuss.elastic.co/t/logstash-for-cloud-flare-enterprise-log/173371)
**Author:** [@Fire\_fire](https://discuss.elastic.co/u/Fire_fire)\ **Replies:** 1\ **Last updated:** [April 7, 2019, 2:33pm UTC](https://discuss.elastic.co/t/logstash-for-cloud-flare-enterprise-log/173371 "2019-04-07T14:33:59Z")
I am find for logstash Cloud flare plgin and not working external plugin like as "https://rubygems.org/gems/logstash-input-cloudflare\_logs/versions/0.1.12" --- ## [Logstash V.7.0 RC 2 installation with Java 11 fails](https://discuss.elastic.co/t/logstash-v-7-0-rc-2-installation-with-java-11-fails/175473)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 2\ **Last updated:** [April 7, 2019, 11:10am UTC](https://discuss.elastic.co/t/logstash-v-7-0-rc-2-installation-with-java-11-fails/175473 "2019-04-07T11:10:34Z")
Hi Logstash dev's and friends, Centos 7 64 Bit (latest all updates) (Virtual Machine) Installation of Elasticsearch and Kibana on the same machine successfull. Tried first to install without Java but installation of Lo… --- ## [JDBC Input Plugin | Pagination | Problem with SQL server if query contains CTE](https://discuss.elastic.co/t/jdbc-input-plugin-pagination-problem-with-sql-server-if-query-contains-cte/175702)
**Author:** [@kumar-pratyaksh](https://discuss.elastic.co/u/kumar-pratyaksh)\ **Replies:** 0\ **Last updated:** [April 7, 2019, 6:17am UTC](https://discuss.elastic.co/t/jdbc-input-plugin-pagination-problem-with-sql-server-if-query-contains-cte/175702 "2019-04-07T06:17:09Z")
In JDBC input plugin, pagination works by enclosing the given source query as a sub query and the applying the offset and limit to the query. The count query also works in the same way. The problem arises when the quer… --- ## [Logstash error with elasticsearch output plugin - Unrecognized SSL message](https://discuss.elastic.co/t/logstash-error-with-elasticsearch-output-plugin-unrecognized-ssl-message/175695)
**Author:** [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)\ **Replies:** 1\ **Last updated:** [April 7, 2019, 6:07am UTC](https://discuss.elastic.co/t/logstash-error-with-elasticsearch-output-plugin-unrecognized-ssl-message/175695 "2019-04-07T06:07:46Z")
Hello Team, I am getting unrecognised SSL error when i use elasticsearch output pipeline in my logstash located in different machine. I am using another logstash in my elasticsearch machine and it is indexing data prop… --- ## [Logstash jdbc config:Unable to connect to database](https://discuss.elastic.co/t/logstash-jdbc-config-unable-to-connect-to-database/175696)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [April 7, 2019, 4:10am UTC](https://discuss.elastic.co/t/logstash-jdbc-config-unable-to-connect-to-database/175696 "2019-04-07T04:10:38Z")
hi all, i am using following input jdbc in my logstash config file: input { jdbc { jdbc\_driver\_library =\> "sqljdbc42.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_connection\_s… --- ## [Logstash Central Management Feedback & Request](https://discuss.elastic.co/t/logstash-central-management-feedback-request/175694)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 0\ **Last updated:** [April 7, 2019, 1:58am UTC](https://discuss.elastic.co/t/logstash-central-management-feedback-request/175694 "2019-04-07T01:58:58Z")
Team, I have to say I really love the central management feature. This has become a handy feature requiring less operational management of the logstash infrastructure. Love thats its quick to configure. Some items for … --- ## [\_grokparsefailure inspite of working well with grok debugger](https://discuss.elastic.co/t/grokparsefailure-inspite-of-working-well-with-grok-debugger/175669)
**Author:** [@yogeshwar\_Trehan](https://discuss.elastic.co/u/yogeshwar_Trehan)\ **Replies:** 9\ **Last updated:** [April 6, 2019, 1:18pm UTC](https://discuss.elastic.co/t/grokparsefailure-inspite-of-working-well-with-grok-debugger/175669 "2019-04-06T13:18:38Z")
I am trying to send logs to elasticsearch using logstash. Following is the logstash config file - input { beats { port =\> "5044" } } filter { grok { patterns\_dir =\> \["/etc/logstash/… --- ## [High CPU usage. Logstash can't work with persistent queue](https://discuss.elastic.co/t/high-cpu-usage-logstash-cant-work-with-persistent-queue/175674)
**Author:** [@Fedele\_Mantuano](https://discuss.elastic.co/u/Fedele_Mantuano)\ **Replies:** 0\ **Last updated:** [April 6, 2019, 12:14pm UTC](https://discuss.elastic.co/t/high-cpu-usage-logstash-cant-work-with-persistent-queue/175674 "2019-04-06T12:14:17Z")
Logstash: 6.7.0 CPU: 2 core Heap Space: 2GB Hi community, I have a Logstash server with a persistent queue of 4GB on disk. Few days ago I had an issue with the number of open files. I saw this issue in Logstash logs… --- ## [Lumberjack input: Kafka output the pipeline is blocked, temporary refusing new connection](https://discuss.elastic.co/t/lumberjack-input-kafka-output-the-pipeline-is-blocked-temporary-refusing-new-connection/173264)
**Author:** [@bijucyborg](https://discuss.elastic.co/u/bijucyborg)\ **Replies:** 1\ **Last updated:** [April 6, 2019, 9:01am UTC](https://discuss.elastic.co/t/lumberjack-input-kafka-output-the-pipeline-is-blocked-temporary-refusing-new-connection/173264 "2019-04-06T09:01:58Z")
After we upgraded OS packages on the logstash server, logstash has stopped transmitting messages to Kafka. This is quite an old environment and uses the lumberjack plugin. The architecture is somewhat like this Logstas… --- ## [To create a date field in logstash](https://discuss.elastic.co/t/to-create-a-date-field-in-logstash/175364)
**Author:** [@sagarleo](https://discuss.elastic.co/u/sagarleo)\ **Replies:** 1\ **Last updated:** [April 6, 2019, 8:55am UTC](https://discuss.elastic.co/t/to-create-a-date-field-in-logstash/175364 "2019-04-06T08:55:33Z")
I'm trying to create a date field using logstash filter . The field i created extracts time part from logs but when trying to visualize in kibana as date histograms. This newtimestamp field i created in logstash do not a… --- ## [Logstash config file interpolation issue](https://discuss.elastic.co/t/logstash-config-file-interpolation-issue/175662)
**Author:** [@human39](https://discuss.elastic.co/u/human39)\ **Replies:** 0\ **Last updated:** [April 6, 2019, 4:28am UTC](https://discuss.elastic.co/t/logstash-config-file-interpolation-issue/175662 "2019-04-06T04:28:31Z")
I'm having an issue that I'm finally giving up on and I need to ask for some help. Here is what I'm doing: ... geoip { source =\> "\[system\]\[auth\]\[ssh\]\[ip\]" target =\> "\[system\]\[auth\]\[ssh\]\[geoip\]" … --- ## [Ingest json file](https://discuss.elastic.co/t/ingest-json-file/175652)
**Author:** [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)\ **Replies:** 6\ **Last updated:** [April 6, 2019, 12:00am UTC](https://discuss.elastic.co/t/ingest-json-file/175652 "2019-04-06T00:00:38Z")
Currently I'm trying to ingest the following json file: my\_file.json { "key\_1": { "key\_1-a": "value\_a", "key\_1-b": "value\_b" }, "key\_2": { "key\_2-a": "value\_a", "key\_2-b": "value\_b" } } my\_conf… --- ## [Installation of module netflow in Logstash 6.5.4](https://discuss.elastic.co/t/installation-of-module-netflow-in-logstash-6-5-4/175421)
**Author:** [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Replies:** 2\ **Last updated:** [April 5, 2019, 10:19pm UTC](https://discuss.elastic.co/t/installation-of-module-netflow-in-logstash-6-5-4/175421 "2019-04-05T22:19:15Z")
Hi All I'm trying to install the module netflow for logstash with the online guide https://www.elastic.co/guide/en/logstash/current/netflow-module.html but I have the problem. I stop the service logstash on my centos … --- ## [Need Help Parsing Nginx SSL Requests With Grok](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282)
**Author:** [@bcisse](https://discuss.elastic.co/u/bcisse)\ **Replies:** 3\ **Last updated:** [April 5, 2019, 8:24pm UTC](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282 "2019-04-05T20:24:26Z")
Hello all, I'm seing "\_grokparsefailure" and "\_geoip\_lookup\_failure" errors when Logstash attempts to parse nginx ssl requests. Like for instance when parsing the following: xxx.xxx.xxx.xxx - - \[03/Apr/2019:21:05:55 +0… --- ## [Is output order guaranteed?](https://discuss.elastic.co/t/is-output-order-guaranteed/175639)
**Author:** [@smbullet](https://discuss.elastic.co/u/smbullet)\ **Replies:** 2\ **Last updated:** [April 5, 2019, 6:22pm UTC](https://discuss.elastic.co/t/is-output-order-guaranteed/175639 "2019-04-05T18:22:32Z")
If I have several outputs defined, are my events guaranteed to hit each output in the order they are defined? I want to have an output plugin add a tag if it fails and have a conditional that will send my event to a fil… --- ## [File input plugin does not read files](https://discuss.elastic.co/t/file-input-plugin-does-not-read-files/174769)
**Author:** [@Nathan\_Sowatskey](https://discuss.elastic.co/u/Nathan_Sowatskey)\ **Replies:** 5\ **Last updated:** [April 5, 2019, 6:12pm UTC](https://discuss.elastic.co/t/file-input-plugin-does-not-read-files/174769 "2019-04-05T18:12:11Z")
I have a file input plugin configured as below. The first time I ran Logstash with this configuration, I think it read the files in question and created an index. Subsequently, it definitely has not. A similar configura… --- ## [Remove json new line \\n](https://discuss.elastic.co/t/remove-json-new-line-n/175628)
**Author:** [@Jacob-N](https://discuss.elastic.co/u/Jacob-N)\ **Replies:** 2\ **Last updated:** [April 5, 2019, 6:10pm UTC](https://discuss.elastic.co/t/remove-json-new-line-n/175628 "2019-04-05T18:10:20Z")
I am pulling a JSON input via http\_poller, the data has "\\n" throughout the data that I would like to remove it Here is an example of a date that contains the "\\n" "O 151007Z FEB 17\\n" Here is my input input{ http\_p… --- ## [Ingesting Zenoss data via Logstash](https://discuss.elastic.co/t/ingesting-zenoss-data-via-logstash/175640)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [April 5, 2019, 6:01pm UTC](https://discuss.elastic.co/t/ingesting-zenoss-data-via-logstash/175640 "2019-04-05T18:01:35Z")
We're trying to offload some of our Zenoss data from Splunk to ES via Logstash. There's a Zenoss plugin for Logstash but it stops being supported after 5.4. Is there another ingest tool that we can use for our Zenoss d… --- ## [Logstash node api is not working in version 6.6.2](https://discuss.elastic.co/t/logstash-node-api-is-not-working-in-version-6-6-2/175624)
**Author:** [@Samantha\_Molina\_Sier](https://discuss.elastic.co/u/Samantha_Molina_Sier)\ **Replies:** 0\ **Last updated:** [April 5, 2019, 3:23pm UTC](https://discuss.elastic.co/t/logstash-node-api-is-not-working-in-version-6-6-2/175624 "2019-04-05T15:23:33Z")
Hi all, I am working with Logstash 6.6.2. Currently, logstash start up as Windows Service, and I want to re run a single pipeline by id using the Logstash API. Also I was reading the documentation for my version but I d… --- ## [Logtrail plugin is not displaying the data](https://discuss.elastic.co/t/logtrail-plugin-is-not-displaying-the-data/175614)
**Author:** [@venkatk](https://discuss.elastic.co/u/venkatk)\ **Replies:** 4\ **Last updated:** [April 5, 2019, 3:23pm UTC](https://discuss.elastic.co/t/logtrail-plugin-is-not-displaying-the-data/175614 "2019-04-05T15:23:32Z")
Hi, I have installed logtrail plugin in Kibana, I am not able to see the data in logtrail, but I am able to view the data in Kibana dashboard. Here is my logtrail.json file: { "index\_patterns" : \[ { "es": { "defau… --- ## [Logstash getting response code 500](https://discuss.elastic.co/t/logstash-getting-response-code-500/175610)
**Author:** [@jeevan\_jena](https://discuss.elastic.co/u/jeevan_jena)\ **Replies:** 1\ **Last updated:** [April 5, 2019, 3:18pm UTC](https://discuss.elastic.co/t/logstash-getting-response-code-500/175610 "2019-04-05T15:18:15Z")
Hi I have configured the elastic URL and and the URL on its own opens in the browser also. But when i run my image in the docker terminal I get a 500, \[2019-04-05T13:57:30,506\]\[WARN \]\[logstash.outputs.elasticsearch\] Att… --- ## [Deleting logstash logs older than 4 days](https://discuss.elastic.co/t/deleting-logstash-logs-older-than-4-days/174341)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 6\ **Last updated:** [April 5, 2019, 2:18pm UTC](https://discuss.elastic.co/t/deleting-logstash-logs-older-than-4-days/174341 "2019-04-05T14:18:48Z")
My log4j.properties like below. How can i edit it to delete logs older than 4 days status = error name = LogstashPropertiesConfig appender.console.type = Console appender.console.name = plain\_console appender.console.l… --- ## [Mutate fields](https://discuss.elastic.co/t/mutate-fields/175489)
**Author:** [@therealtoby](https://discuss.elastic.co/u/therealtoby)\ **Replies:** 1\ **Last updated:** [April 5, 2019, 12:47pm UTC](https://discuss.elastic.co/t/mutate-fields/175489 "2019-04-05T12:47:29Z")
Hello, I need to change the below. I'm using mutate and rename within. When I do mutate { update =\> { "source-address" =\> "source.ip" } } I get the result "source.ip" =\> "0.0.0.0" --\> this works the way it … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=569) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=571)