# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=571 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 572 --- ## [Remove backslash "\\\\s" about in Logstash](https://discuss.elastic.co/t/remove-backslash-s-about-in-logstash/175509)
**Author:** [@khergner](https://discuss.elastic.co/u/khergner)\ **Replies:** 1\ **Last updated:** [April 5, 2019, 12:43pm UTC](https://discuss.elastic.co/t/remove-backslash-s-about-in-logstash/175509 "2019-04-05T12:43:57Z")
Hi, There is json data so I want to parse use but ı need \\" remove in json line. How can ı remove \*\*\\"\*\*quate? I know using gsub but ı can't. Exampler data; { "dateTime":"\\"2019-03-27T00:59:15\\"", "scStatus":2… --- ## [Create folder to save logs from Filebeat](https://discuss.elastic.co/t/create-folder-to-save-logs-from-filebeat/175535)
**Author:** [@Donny\_Nightfrost](https://discuss.elastic.co/u/Donny_Nightfrost)\ **Replies:** 1\ **Last updated:** [April 5, 2019, 12:32pm UTC](https://discuss.elastic.co/t/create-folder-to-save-logs-from-filebeat/175535 "2019-04-05T12:32:18Z")
Greetings, I have a simulation I wanted to try : Filebeat (one agent or more) send logs to another machine (where Logstash located) Logstash to receive the logs and do the filters Logs will be saved on specified direct… --- ## [Logsatsh not stashing a huge file](https://discuss.elastic.co/t/logsatsh-not-stashing-a-huge-file/175530)
**Author:** [@sana1](https://discuss.elastic.co/u/sana1)\ **Replies:** 7\ **Last updated:** [April 5, 2019, 10:22am UTC](https://discuss.elastic.co/t/logsatsh-not-stashing-a-huge-file/175530 "2019-04-05T10:22:43Z")
I have a file of ~ 23gb, I am using filebeat for the logstash input, but Logstash only parses a few lines from the start of the log file, what should I do? --- ## [Upsert function in Logstash not working](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938)
**Author:** [@shruti51](https://discuss.elastic.co/u/shruti51)\ **Replies:** 3\ **Last updated:** [April 5, 2019, 9:46am UTC](https://discuss.elastic.co/t/upsert-function-in-logstash-not-working/173938 "2019-04-05T09:46:51Z")
HI, I am trying to use upsert function to update value of column in an index. My column is not getting updated.It shows only sagstatus = SAGReceived. input { beats { port =\> 5044 } } The filter part of this f… --- ## [Netflow Traffic in Windows 7 Server](https://discuss.elastic.co/t/netflow-traffic-in-windows-7-server/175559)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 0\ **Last updated:** [April 5, 2019, 9:42am UTC](https://discuss.elastic.co/t/netflow-traffic-in-windows-7-server/175559 "2019-04-05T09:42:35Z")
Hi- I have installed logstash on a Windows-7 server and enabled Netflow module on UDP Port listening on 2055. I could see the dashboards got loaded in Kibana. But I don't see any data publishing it from the server. I c… --- ## [Please help, Logstash can not parse field value to created dynamic index](https://discuss.elastic.co/t/please-help-logstash-can-not-parse-field-value-to-created-dynamic-index/175188)
**Author:** [@Worradorn\_Sirisang](https://discuss.elastic.co/u/Worradorn_Sirisang)\ **Replies:** 12\ **Last updated:** [April 5, 2019, 9:20am UTC](https://discuss.elastic.co/t/please-help-logstash-can-not-parse-field-value-to-created-dynamic-index/175188 "2019-04-05T09:20:52Z")
Hello team, I face a problem about logstash send data to missing elasticsearch index. my architecture is outlined below. Filebeats -\> Logstash -\> Elasticsearch/AWS Elasticsearch my machine have Filebeat agent for col… --- ## [Tests failling for logstash-5.6.x](https://discuss.elastic.co/t/tests-failling-for-logstash-5-6-x/175520)
**Author:** [@jhon](https://discuss.elastic.co/u/jhon)\ **Replies:** 1\ **Last updated:** [April 5, 2019, 8:35am UTC](https://discuss.elastic.co/t/tests-failling-for-logstash-5-6-x/175520 "2019-04-05T08:35:48Z")
I have performed logstash testing on version 5.6.15 and 5.6.13. In both the versions we have encountered below errors . Error \[ Error Bundler::InstallError, retrying 1/10 An error occurred while installing logstash-co… --- ## [Logstash 6.7 - Cannot connect mysql](https://discuss.elastic.co/t/logstash-6-7-cannot-connect-mysql/175541)
**Author:** [@nopparat](https://discuss.elastic.co/u/nopparat)\ **Replies:** 0\ **Last updated:** [April 5, 2019, 8:27am UTC](https://discuss.elastic.co/t/logstash-6-7-cannot-connect-mysql/175541 "2019-04-05T08:27:16Z")
Hi all, Could you please check the code. Environment : OS : Windows 10 Web Server : Apache Mysql : 5.05 JDBC : 5.1.24 Elasticsearch : 6.7(zip) Kibana : 6.7(zip) Logstash : 6.7(zip) elas.conf : input { jdbc { … --- ## [If condition working but not else](https://discuss.elastic.co/t/if-condition-working-but-not-else/175385)
**Author:** [@sana1](https://discuss.elastic.co/u/sana1)\ **Replies:** 5\ **Last updated:** [April 5, 2019, 7:15am UTC](https://discuss.elastic.co/t/if-condition-working-but-not-else/175385 "2019-04-05T07:15:05Z")
I have a random log file which contain diff data, I have created fields in it using mutate filter, my if conditions are working but not my else conditions working. log line : 90-50-31: ill ill you are You if \[ty\] =~ "Y… --- ## [Failed to load /usr/share/logstash/postgresql.jar](https://discuss.elastic.co/t/failed-to-load-usr-share-logstash-postgresql-jar/175514)
**Author:** [@skowron-line](https://discuss.elastic.co/u/skowron-line)\ **Replies:** 0\ **Last updated:** [April 5, 2019, 5:06am UTC](https://discuss.elastic.co/t/failed-to-load-usr-share-logstash-postgresql-jar/175514 "2019-04-05T05:06:03Z")
I havaing trouble with running logstash on redhat 7.6 Im using logstash 6.4.3 with Jdbc plugin I have created startup file like \[Unit\] Description=logstash \[Service\] Type=simple User=logstash Group=logstash # Load e… --- ## [Elastic Cloud Stack Pipelines](https://discuss.elastic.co/t/elastic-cloud-stack-pipelines/175417)
**Author:** [@Dr\_Slump](https://discuss.elastic.co/u/Dr_Slump)\ **Replies:** 5\ **Last updated:** [April 5, 2019, 4:43am UTC](https://discuss.elastic.co/t/elastic-cloud-stack-pipelines/175417 "2019-04-05T04:43:04Z")
I had an local instance 6.2 in which ran an imap pipeline without problems. I was evaluating the cloud solution of ELK in version 7.0 and I see that from the dashboard I can create pipelines, but it seems that these do … --- ## [Config error from logstash 5.6 to 6.7 migration](https://discuss.elastic.co/t/config-error-from-logstash-5-6-to-6-7-migration/175322)
**Author:** [@mkain](https://discuss.elastic.co/u/mkain)\ **Replies:** 2\ **Last updated:** [April 5, 2019, 4:12am UTC](https://discuss.elastic.co/t/config-error-from-logstash-5-6-to-6-7-migration/175322 "2019-04-05T04:12:41Z")
Hi, On Logstash 5.6 I have following working config. input { tcp { port =\> 514 type =\> syslog } udp { port =\> 514 type =\> syslog } } filter { if \[type\] == "syslog" { … --- ## [Logstash failing on InvalidFrameProtocolException: Invalid Frame Type, received: 69/84](https://discuss.elastic.co/t/logstash-failing-on-invalidframeprotocolexception-invalid-frame-type-received-69-84/175423)
**Author:** [@Tharun](https://discuss.elastic.co/u/Tharun)\ **Replies:** 7\ **Last updated:** [April 5, 2019, 12:52am UTC](https://discuss.elastic.co/t/logstash-failing-on-invalidframeprotocolexception-invalid-frame-type-received-69-84/175423 "2019-04-05T00:52:03Z")
Hello, Using logstash version 6.5.4 and filebeats version 6.4.2. Sometimes logstash is going down because of this, but couldn't find any misconfiguration that is causing this issue, can someone please help me out on th… --- ## [Why \_jsonparsefailure?](https://discuss.elastic.co/t/why-jsonparsefailure/175448)
**Author:** [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)\ **Replies:** 9\ **Last updated:** [April 4, 2019, 8:34pm UTC](https://discuss.elastic.co/t/why-jsonparsefailure/175448 "2019-04-04T20:34:10Z")
Having \_jsonparsefailure, and json parser says messsage is good json. I have this configuration file: input { http\_poller { urls =\> { url =\> "https://urlhost:443/remote/core.executeQuery?queryId=###&:output=json" } … --- ## [Logstash snmp input plugin as a service](https://discuss.elastic.co/t/logstash-snmp-input-plugin-as-a-service/175481)
**Author:** [@Francesco\_Vanzelli](https://discuss.elastic.co/u/Francesco_Vanzelli)\ **Replies:** 0\ **Last updated:** [April 4, 2019, 8:01pm UTC](https://discuss.elastic.co/t/logstash-snmp-input-plugin-as-a-service/175481 "2019-04-04T20:01:33Z")
Hi, I'm using elastinc stack 6.7 (installed on Centos 7) and I have a issue with logstash and snmp input plugin. I created differenf .conf file (syslog, filebeat, snmp, ..) all works fine but the snmp plugin no report d… --- ## [Udp plugin queue\_size and persistent queue](https://discuss.elastic.co/t/udp-plugin-queue-size-and-persistent-queue/175476)
**Author:** [@Jon\_Campbell](https://discuss.elastic.co/u/Jon_Campbell)\ **Replies:** 0\ **Last updated:** [April 4, 2019, 7:14pm UTC](https://discuss.elastic.co/t/udp-plugin-queue-size-and-persistent-queue/175476 "2019-04-04T19:14:23Z")
The queue\_size in the UDP plugin determines how many packets are held in memory before being dropped. But, if I have the pipeline setup with a persistent queue, does the queue\_size still drop the packets or does it write… --- ## [Mutate filter a word between quotes](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844)
**Author:** [@Woolis\_Xiibil\_Peek](https://discuss.elastic.co/u/Woolis_Xiibil_Peek)\ **Replies:** 3\ **Last updated:** [April 4, 2019, 6:03pm UTC](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844 "2019-04-04T18:03:52Z")
Hi. I want to create a filter in a logstash configuration with a word between quotation marks. Something like this "word":"1234567890" I want to mutate this part of the log message so I can create a new field for the p… --- ## [HTTP input size limit?](https://discuss.elastic.co/t/http-input-size-limit/175459)
**Author:** [@Kyle\_Ryan](https://discuss.elastic.co/u/Kyle_Ryan)\ **Replies:** 0\ **Last updated:** [April 4, 2019, 6:02pm UTC](https://discuss.elastic.co/t/http-input-size-limit/175459 "2019-04-04T18:02:57Z")
Hi, I have a logstash config using the http input plugin to listen for requests consisting of a list of json objects. These requests are sometimes quite large and I've noticed that some of the records being sent to logs… --- ## [No living connections in the connection pool - Logstash Elasticsearch connectivity issue](https://discuss.elastic.co/t/no-living-connections-in-the-connection-pool-logstash-elasticsearch-connectivity-issue/175457)
**Author:** [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)\ **Replies:** 0\ **Last updated:** [April 4, 2019, 5:49pm UTC](https://discuss.elastic.co/t/no-living-connections-in-the-connection-pool-logstash-elasticsearch-connectivity-issue/175457 "2019-04-04T17:49:05Z")
Hello, We have 10+ logstash nodes (6.2.4) behind AWS Classic Loadbalancer. Everything was working fine and we started seeing these errors on the nodes. These errors first appeared on some of the nodes while other were w… --- ## [Parsing KV filter is not working](https://discuss.elastic.co/t/parsing-kv-filter-is-not-working/175192)
**Author:** [@Loup](https://discuss.elastic.co/u/Loup)\ **Replies:** 2\ **Last updated:** [April 4, 2019, 3:23pm UTC](https://discuss.elastic.co/t/parsing-kv-filter-is-not-working/175192 "2019-04-04T15:23:47Z")
Hi, I need to parse each field from a McAfee WebGateway like having a field url, ip source, destination... Can you please help me to understand my mistakes with kv and grok? I do not success to make the kv works. Here i… --- ## [Creating Multiple Pipelines Arcsight, Netflow, filebeat, packet beat etc](https://discuss.elastic.co/t/creating-multiple-pipelines-arcsight-netflow-filebeat-packet-beat-etc/175100)
**Author:** [@vidurmittal](https://discuss.elastic.co/u/vidurmittal)\ **Replies:** 5\ **Last updated:** [April 4, 2019, 3:09pm UTC](https://discuss.elastic.co/t/creating-multiple-pipelines-arcsight-netflow-filebeat-packet-beat-etc/175100 "2019-04-04T15:09:56Z")
Hi, I am trying to install module Arcsight, netflow etc with currently running services like filebeat, packetbeat, suricata, wazuh but when I am installing Arcsight or netflow module, I am not to insert indexes, dashboa… --- ## [Parsing Json to Cloudwatch Log Group in Logstash config](https://discuss.elastic.co/t/parsing-json-to-cloudwatch-log-group-in-logstash-config/175275)
**Author:** [@drj](https://discuss.elastic.co/u/drj)\ **Replies:** 6\ **Last updated:** [April 4, 2019, 2:32pm UTC](https://discuss.elastic.co/t/parsing-json-to-cloudwatch-log-group-in-logstash-config/175275 "2019-04-04T14:32:57Z")
I am in the process trying to change my logstash config from grok to json ... Also Is there a way to have all fields injson to become fields over in kibana, rather than the whole json blob being stuck in the message fiel… --- ## [Log4j2.properties not getting honored?](https://discuss.elastic.co/t/log4j2-properties-not-getting-honored/175189)
**Author:** [@romariol](https://discuss.elastic.co/u/romariol)\ **Replies:** 4\ **Last updated:** [April 4, 2019, 1:58pm UTC](https://discuss.elastic.co/t/log4j2-properties-not-getting-honored/175189 "2019-04-04T13:58:18Z")
Hi, I'm getting warning in my logstash-plain logging file regarding (in this case) the logstash.licensechecker.licensereader. The entry is like this: \[2019-04-03T14:12:05,228\]\[WARN \]\[logstash.licensechecker.licenserea… --- ## [Processing sequence for logstash - filter - mutate](https://discuss.elastic.co/t/processing-sequence-for-logstash-filter-mutate/175425)
**Author:** [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\ **Replies:** 0\ **Last updated:** [April 4, 2019, 1:43pm UTC](https://discuss.elastic.co/t/processing-sequence-for-logstash-filter-mutate/175425 "2019-04-04T13:43:26Z")
Hi there, The filter mutate has a processing order according to the docs here. I would like to know the order within the rename itself. Scenario: I am trying to ecs Windows Security Logs with logstash-mutate. There a… --- ## [JDBC Input based on timestamp, concern regarding omitting an event](https://discuss.elastic.co/t/jdbc-input-based-on-timestamp-concern-regarding-omitting-an-event/175349)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 3\ **Last updated:** [April 4, 2019, 12:35pm UTC](https://discuss.elastic.co/t/jdbc-input-based-on-timestamp-concern-regarding-omitting-an-event/175349 "2019-04-04T12:35:49Z")
Hi Guys, I'm currently looking into JDBC Input plugin for Oracle and I have one concern. Assuming my pipeline is timestamp based with the following format: yyyy-mm-dd hh:mm:ss. Let's say that there are two event that oc… --- ## [Mutating several fields at once](https://discuss.elastic.co/t/mutating-several-fields-at-once/175402)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 0\ **Last updated:** [April 4, 2019, 12:12pm UTC](https://discuss.elastic.co/t/mutating-several-fields-at-once/175402 "2019-04-04T12:12:35Z")
Hi Guys, I'm looking for a more efficient way to convert my fields. My output looks like this: "id" =\> 1.0 "code" =\> 200.0 "name" =\> "Something " "middlename" =\> " Hok" "lastname" =\> "Something as well" I n… --- ## [Move all @metadata fields at once](https://discuss.elastic.co/t/move-all-metadata-fields-at-once/175331)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 3\ **Last updated:** [April 4, 2019, 11:42am UTC](https://discuss.elastic.co/t/move-all-metadata-fields-at-once/175331 "2019-04-04T11:42:09Z")
Hi, is there a way to move all @metadata fields at once so i can preserve it over multiple logstash instances until it gets to ES? Maybe something like a recursive mutate { rename =\> { "@metadata" =\> "meta" } } becau… --- ## [Dateparsefailure while trying to overwrite timestamp with result date in same format](https://discuss.elastic.co/t/dateparsefailure-while-trying-to-overwrite-timestamp-with-result-date-in-same-format/175381)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 2\ **Last updated:** [April 4, 2019, 11:27am UTC](https://discuss.elastic.co/t/dateparsefailure-while-trying-to-overwrite-timestamp-with-result-date-in-same-format/175381 "2019-04-04T11:27:52Z")
Hello, I'm getting my results from JDBC query and as a result I have two columns: "process\_date\_local" =\> 2019-01-08T12:35:52.000Z, "@timestamp" =\> 2019-04-04T10:16:33.621Z, I'm trying to use process\_date\_local as a @… --- ## [Grok and aggregate log information](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163)
**Author:** [@Lebedev](https://discuss.elastic.co/u/Lebedev)\ **Replies:** 3\ **Last updated:** [April 4, 2019, 11:22am UTC](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163 "2019-04-04T11:22:28Z")
Dear, collegues pls help me! I have input log following format: Exm: 1 value 1 100 1 value1 2 mean 2 text 2 something 3 SOAP 3 example\_text I need to convert output log in Real-time in the folo… --- ## [Parsing sample data, but no output printed to the console](https://discuss.elastic.co/t/parsing-sample-data-but-no-output-printed-to-the-console/173735)
**Author:** [@Miao](https://discuss.elastic.co/u/Miao)\ **Replies:** 7\ **Last updated:** [April 4, 2019, 10:40am UTC](https://discuss.elastic.co/t/parsing-sample-data-but-no-output-printed-to-the-console/173735 "2019-04-04T10:40:54Z")
I downloaded LogStash 6.6.2 today and I am currently going through the tutorial here. On my Windows 10 machine, I followed the instructions here to install/configure/run Filebeat. I followed every single step in the tu… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=570) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=572)