# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=585 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 586 --- ## [Logstash error with multiple](https://discuss.elastic.co/t/logstash-error-with-multiple/172103)
**Author:** [@Thibaut603](https://discuss.elastic.co/u/Thibaut603)\ **Replies:** 2\ **Last updated:** [March 13, 2019, 11:59am UTC](https://discuss.elastic.co/t/logstash-error-with-multiple/172103 "2019-03-13T11:59:40Z")
Hello guys i'm a little bit stuck with my config logstash i try to have multiple pipeline one for AD events and Palo alto syslog event so i've configure the file pipeline.yml like this i've a question do i need to se… --- ## [Cannot parse file using Logstash on my Win10 system](https://discuss.elastic.co/t/cannot-parse-file-using-logstash-on-my-win10-system/172127)
**Author:** [@clabnet](https://discuss.elastic.co/u/clabnet)\ **Replies:** 2\ **Last updated:** [March 13, 2019, 10:57am UTC](https://discuss.elastic.co/t/cannot-parse-file-using-logstash-on-my-win10-system/172127 "2019-03-13T10:57:57Z")
Hi, my first post here. I'm using Logstash v. 6.6.0. My goal is to parse log using Grok patterns. This is my start command: logstash -f ../config/logstash.conf --verbose This is my logstash.conf (very basic) : inpu… --- ## [Logstash elasticsearch output plugin crashes elasticsearch](https://discuss.elastic.co/t/logstash-elasticsearch-output-plugin-crashes-elasticsearch/171930)
**Author:** [@hagit](https://discuss.elastic.co/u/hagit)\ **Replies:** 2\ **Last updated:** [March 12, 2019, 11:29am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-plugin-crashes-elasticsearch/171930 "2019-03-12T11:29:00Z")
Hi, I am using logstash 6.5.4 with elasticsearch output plugin to index 15M documents and it keeps crashing my elasticsearch (6.5.4). I'm getting: \[WARN \]\[logstash.outputs.elasticsearch\] Marking url as dead. Last error… --- ## [Sprintf format in if statement](https://discuss.elastic.co/t/sprintf-format-in-if-statement/172087)
**Author:** [@jcarre31](https://discuss.elastic.co/u/jcarre31)\ **Replies:** 0\ **Last updated:** [March 13, 2019, 8:35am UTC](https://discuss.elastic.co/t/sprintf-format-in-if-statement/172087 "2019-03-13T08:35:58Z")
I try to use a sprintf format in a IF statement in output bloc but failled. filter { mutate { add\_field =\> { "systype" =\> "cpu" } } } output { if \[event\]\[dataset\] == "system.%{systype}" { elasticsear… --- ## [Logstash 6.4.2 parse Cisco ASA Log](https://discuss.elastic.co/t/logstash-6-4-2-parse-cisco-asa-log/172077)
**Author:** [@jihaibing](https://discuss.elastic.co/u/jihaibing)\ **Replies:** 0\ **Last updated:** [March 13, 2019, 7:47am UTC](https://discuss.elastic.co/t/logstash-6-4-2-parse-cisco-asa-log/172077 "2019-03-13T07:47:46Z")
i have a syslog server with my asa's log, and i installed filebeat agent on it, then i can see asa's log on my logstash. now i don't create any filter on my logstash . on elk. picture as below and who can tell me how… --- ## [Logstash losing connection to elastic intermittently](https://discuss.elastic.co/t/logstash-losing-connection-to-elastic-intermittently/172042)
**Author:** [@Saurav\_Sen](https://discuss.elastic.co/u/Saurav_Sen)\ **Replies:** 0\ **Last updated:** [March 13, 2019, 1:43am UTC](https://discuss.elastic.co/t/logstash-losing-connection-to-elastic-intermittently/172042 "2019-03-13T01:43:35Z")
I am running Elastic stack on Docker swarm with xpac monitoring enabled. Everything is running fine with the cluster status as green. Data Nodes : 4 Ingest Nodes : 4 logstash nodes : 4 but when I tail the logs for lo… --- ## [Multiline grok of consecutive events of the same type with joining](https://discuss.elastic.co/t/multiline-grok-of-consecutive-events-of-the-same-type-with-joining/172025)
**Author:** [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\ **Replies:** 2\ **Last updated:** [March 12, 2019, 8:26pm UTC](https://discuss.elastic.co/t/multiline-grok-of-consecutive-events-of-the-same-type-with-joining/172025 "2019-03-12T20:26:48Z")
Consider this log file structure: patA1 .\*? patA2 .\*? patA3 ... (many lines here) patB1 .\*? patB2 .\*? patB3 patB1 .\*? patB2 .\*? patB3 In the above, consider patXY to be different regex patterns, i.e. the first line abo… --- ## [Logstash trims part of log line](https://discuss.elastic.co/t/logstash-trims-part-of-log-line/171843)
**Author:** [@MR\_A](https://discuss.elastic.co/u/MR_A)\ **Replies:** 6\ **Last updated:** [March 12, 2019, 7:50pm UTC](https://discuss.elastic.co/t/logstash-trims-part-of-log-line/171843 "2019-03-12T19:50:10Z")
I have some problem with log files processing by Logstash (I think). Sometimes we have "\_grokparsefailure" tagged documents. Here is an example: Note, there is no functionality to remove first part of the message. Y… --- ## [Removing a single value from an array](https://discuss.elastic.co/t/removing-a-single-value-from-an-array/172016)
**Author:** [@tszyro](https://discuss.elastic.co/u/tszyro)\ **Replies:** 3\ **Last updated:** [March 12, 2019, 7:49pm UTC](https://discuss.elastic.co/t/removing-a-single-value-from-an-array/172016 "2019-03-12T19:49:14Z")
I can't figure out how to remove a single value from an array. I am trying to build a pipeline where I clone an event do different operation on the copy and finally output an original event into one index and the clone … --- ## [Logstash to send logs to Elasticsearch on Prem](https://discuss.elastic.co/t/logstash-to-send-logs-to-elasticsearch-on-prem/172010)
**Author:** [@Habbiot](https://discuss.elastic.co/u/Habbiot)\ **Replies:** 0\ **Last updated:** [March 12, 2019, 5:16pm UTC](https://discuss.elastic.co/t/logstash-to-send-logs-to-elasticsearch-on-prem/172010 "2019-03-12T17:16:14Z")
We have logstash on AWS and need to send the logs to ELK stack in our data center. How can i point the logstash to Elasticsearch on Prem ? --- ## [Relate events generated to size](https://discuss.elastic.co/t/relate-events-generated-to-size/171996)
**Author:** [@rahulkumar1](https://discuss.elastic.co/u/rahulkumar1)\ **Replies:** 3\ **Last updated:** [March 12, 2019, 5:07pm UTC](https://discuss.elastic.co/t/relate-events-generated-to-size/171996 "2019-03-12T17:07:09Z")
If a Logstash node is processing 5000 events per second, how can I relate it to size in terms of MB or GB ? --- ## [Merge 2 or more text files data to same index](https://discuss.elastic.co/t/merge-2-or-more-text-files-data-to-same-index/171969)
**Author:** [@RaTheDev](https://discuss.elastic.co/u/RaTheDev)\ **Replies:** 1\ **Last updated:** [March 12, 2019, 3:03pm UTC](https://discuss.elastic.co/t/merge-2-or-more-text-files-data-to-same-index/171969 "2019-03-12T15:03:56Z")
Wondering how to merge the data from below files to same index, as I receive these files at different intervals. One common thing with in these files is the student ID which is primary Key File A: (Student Grades) Stu… --- ## [\[LogStash::Runner\]: Exception on end of comment line - 'The given configuration is invalid. Reason: Expected'](https://discuss.elastic.co/t/logstash-runner-exception-on-end-of-comment-line-the-given-configuration-is-invalid-reason-expected/169564)
**Author:** [@henkepa](https://discuss.elastic.co/u/henkepa)\ **Replies:** 6\ **Last updated:** [March 12, 2019, 1:41pm UTC](https://discuss.elastic.co/t/logstash-runner-exception-on-end-of-comment-line-the-given-configuration-is-invalid-reason-expected/169564 "2019-03-12T13:41:36Z")
OS: Redhat 7 Logstash Version: 6.5.1 The following logstash pipeline.conf: # !!!Attenttion: Comments can raise exceptions -\> be aware!!! input { beats { port =\> "5044" host =\> "0.0.0.0" } } out… --- ## [Logstash does not do anything with file input but starts successfully](https://discuss.elastic.co/t/logstash-does-not-do-anything-with-file-input-but-starts-successfully/171902)
**Author:** [@Gegi\_K](https://discuss.elastic.co/u/Gegi_K)\ **Replies:** 4\ **Last updated:** [March 12, 2019, 12:56pm UTC](https://discuss.elastic.co/t/logstash-does-not-do-anything-with-file-input-but-starts-successfully/171902 "2019-03-12T12:56:49Z")
Hello All, I have an issue where I cannot find what is goint on. I have a plain logstash config file: input { file { path =\> \[ "C:\\Users\\Administrator\\Desktop\\1.txt" \] } } output { elasticsearch { hosts =\> \["loca… --- ## [Send same document to multiple elasticsearch indexes](https://discuss.elastic.co/t/send-same-document-to-multiple-elasticsearch-indexes/171702)
**Author:** [@Praneet\_Khandelwal](https://discuss.elastic.co/u/Praneet_Khandelwal)\ **Replies:** 4\ **Last updated:** [March 12, 2019, 12:50pm UTC](https://discuss.elastic.co/t/send-same-document-to-multiple-elasticsearch-indexes/171702 "2019-03-12T12:50:32Z")
I am processing incoming documents via logstash. And I would like to send the documents to different multiple indices. I have found this approach to solve the problem. output { elasticsearch { host =\> "… --- ## [Ruby syntax](https://discuss.elastic.co/t/ruby-syntax/171899)
**Author:** [@fedwe](https://discuss.elastic.co/u/fedwe)\ **Replies:** 4\ **Last updated:** [March 12, 2019, 12:48pm UTC](https://discuss.elastic.co/t/ruby-syntax/171899 "2019-03-12T12:48:34Z")
How do i write the else if in Ruby. I tried elsif but it didnt work --- ## [Pair key with multiple values from different fields](https://discuss.elastic.co/t/pair-key-with-multiple-values-from-different-fields/170693)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 6\ **Last updated:** [March 12, 2019, 12:39pm UTC](https://discuss.elastic.co/t/pair-key-with-multiple-values-from-different-fields/170693 "2019-03-12T12:39:30Z")
pair key with multiple values from different fields I am looking for method how to pair BUCKET with COSTS and BALANCE the source: ... "BUCKETS": "BUCKET1,BUCKET2,name:BUCKET3,... {n BUCKETs}" "COSTS": "10,20,30,pric… --- ## [JsonPath in Logstash plugin](https://discuss.elastic.co/t/jsonpath-in-logstash-plugin/171947)
**Author:** [@Arko](https://discuss.elastic.co/u/Arko)\ **Replies:** 0\ **Last updated:** [March 12, 2019, 12:22pm UTC](https://discuss.elastic.co/t/jsonpath-in-logstash-plugin/171947 "2019-03-12T12:22:34Z")
I there any option to parse JSON with JsonPath - similar like XML filter plugin with xpath? In Json filter plugin I don't see such option but it would be very helpfull i.e parsing all parameters of objects array. Examp… --- ## [Filebeat log stdout logstash](https://discuss.elastic.co/t/filebeat-log-stdout-logstash/171771)
**Author:** [@wiliamauc85](https://discuss.elastic.co/u/wiliamauc85)\ **Replies:** 2\ **Last updated:** [March 12, 2019, 11:12am UTC](https://discuss.elastic.co/t/filebeat-log-stdout-logstash/171771 "2019-03-12T11:12:32Z")
I'm relatively new to ELK and currently trying to go through this article and I'm trying to just look at the stdout in the logstash console however it doesn't seem to be working. My filebeat.yml config is on the squid s… --- ## [Parsing nested JSON in message field \[Logstash\]\[Filebeat\]](https://discuss.elastic.co/t/parsing-nested-json-in-message-field-logstash-filebeat/171903)
**Author:** [@vkpro](https://discuss.elastic.co/u/vkpro)\ **Replies:** 0\ **Last updated:** [March 12, 2019, 9:28am UTC](https://discuss.elastic.co/t/parsing-nested-json-in-message-field-logstash-filebeat/171903 "2019-03-12T09:28:13Z")
I have log in following format, it is a plain json with nested fields. { "level": "info", "message": { "req": { "headers": { "host": "localhost:8080", "connect… --- ## [Where is default Logstash Java classpath?](https://discuss.elastic.co/t/where-is-default-logstash-java-classpath/171890)
**Author:** [@thangld](https://discuss.elastic.co/u/thangld)\ **Replies:** 0\ **Last updated:** [March 12, 2019, 8:34am UTC](https://discuss.elastic.co/t/where-is-default-logstash-java-classpath/171890 "2019-03-12T08:34:47Z")
Hi, I'm running logstash in Docker Container. When I config input for logstash like this: jdbc { jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/mysql?user=root" jdbc\_driver\_class =\> "com.mysql.… --- ## [Ruby Code out of Logstash Pipeline](https://discuss.elastic.co/t/ruby-code-out-of-logstash-pipeline/171743)
**Author:** [@Michael.Swiss](https://discuss.elastic.co/u/Michael.Swiss)\ **Replies:** 2\ **Last updated:** [March 12, 2019, 7:22am UTC](https://discuss.elastic.co/t/ruby-code-out-of-logstash-pipeline/171743 "2019-03-12T07:22:21Z")
Dear all I am building a filter plugin that calls a ruby .rb code file. The filter itself is well documented. The issues I have is with ruby gems and the transmission of variables: The documentation says that ruby gem… --- ## [Logstash get stuck after Successfully started Logstash API endpoint {:port=\>9600}](https://discuss.elastic.co/t/logstash-get-stuck-after-successfully-started-logstash-api-endpoint-port-9600/171870)
**Author:** [@mandar.raj](https://discuss.elastic.co/u/mandar.raj)\ **Replies:** 0\ **Last updated:** [March 12, 2019, 6:36am UTC](https://discuss.elastic.co/t/logstash-get-stuck-after-successfully-started-logstash-api-endpoint-port-9600/171870 "2019-03-12T06:36:54Z")
When i run config file it stucks at Successfully started Logstash API endpoint {:port=\>9600}, Nothing happens after this. Could you please help me to resolve this. Earlier it was working fine with this config My Config … --- ## [Logstash the number of out events is exactly double the number of in events](https://discuss.elastic.co/t/logstash-the-number-of-out-events-is-exactly-double-the-number-of-in-events/171861)
**Author:** [@bbking](https://discuss.elastic.co/u/bbking)\ **Replies:** 0\ **Last updated:** [March 12, 2019, 5:25am UTC](https://discuss.elastic.co/t/logstash-the-number-of-out-events-is-exactly-double-the-number-of-in-events/171861 "2019-03-12T05:25:22Z")
Hi, I'm trying to understand the metrics returned by \_node/stats/pipelines in logstash. I'm quite confused why the number of out events is exactly doubles the number of in events. Shouldn't it be the same? main is the pi… --- ## [Grok failure inspite of all pattern getting parsed](https://discuss.elastic.co/t/grok-failure-inspite-of-all-pattern-getting-parsed/171775)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 2\ **Last updated:** [March 12, 2019, 3:58am UTC](https://discuss.elastic.co/t/grok-failure-inspite-of-all-pattern-getting-parsed/171775 "2019-03-12T03:58:15Z")
I have a grok pattern (?(\\d{2})/(\\d{2})/(\\d{4}) (\\d{2}):(\\d{2}):(\\d{2}).(\\d{3}) \[A,P\]M):.\*::%{WORD:StudyAuthorityProviderType}: Serializing result stream of %{NUMBER:ImageSize:float} bytes for component %{NOTSPACE:abcid… --- ## [Need help for error " java.lang.IllegalArgumentException: Rejecting mapping update to \[logstash-git\] as the final mapping would have more than 1 type: \[\_doc, doc\]"](https://discuss.elastic.co/t/need-help-for-error-java-lang-illegalargumentexception-rejecting-mapping-update-to-logstash-git-as-the-final-mapping-would-have-more-than-1-type-doc-doc/171499)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 2\ **Last updated:** [March 12, 2019, 2:25am UTC](https://discuss.elastic.co/t/need-help-for-error-java-lang-illegalargumentexception-rejecting-mapping-update-to-logstash-git-as-the-final-mapping-would-have-more-than-1-type-doc-doc/171499 "2019-03-12T02:25:59Z")
Hi team - need your help for this painful issue. My ES Index template with index pattern is "logstash-git" { "template": "git\_template", "index\_patterns":\["logstash-git"\], "mappings": { "doc": { "properties": { … --- ## [File output to multiple files](https://discuss.elastic.co/t/file-output-to-multiple-files/171721)
**Author:** [@romariol](https://discuss.elastic.co/u/romariol)\ **Replies:** 1\ **Last updated:** [March 12, 2019, 1:11am UTC](https://discuss.elastic.co/t/file-output-to-multiple-files/171721 "2019-03-12T01:11:15Z")
I have a Logstash conf where I split an incoming XML into multiple events. I would like to write a file per event. However, the file output writes all the events to a single file (so an event per line). Is there a way to… --- ## [Upgrade from 5.6.2 to 6.5.4](https://discuss.elastic.co/t/upgrade-from-5-6-2-to-6-5-4/171794)
**Author:** [@andreacfm](https://discuss.elastic.co/u/andreacfm)\ **Replies:** 1\ **Last updated:** [March 12, 2019, 12:42am UTC](https://discuss.elastic.co/t/upgrade-from-5-6-2-to-6-5-4/171794 "2019-03-12T00:42:40Z")
I need to upgrade a basic elk stack (kibana + logstash) from version 5.6.2 to 6.5.4. From the docs seems that the versions are compatible and the that a rolling upgrade is possible. My plan is to start upgrading the ela… --- ## [Settings for rabbitMQ input](https://discuss.elastic.co/t/settings-for-rabbitmq-input/171837)
**Author:** [@lsdev14](https://discuss.elastic.co/u/lsdev14)\ **Replies:** 0\ **Last updated:** [March 11, 2019, 10:27pm UTC](https://discuss.elastic.co/t/settings-for-rabbitmq-input/171837 "2019-03-11T22:27:16Z")
Hi, I have some queues in the rabbitMQ and I would like some tips to setting the consumers in a cluster of logstash instances. I'm using this input plugin https://www.elastic.co/guide/en/logstash/current/plugins-inputs-… --- ## [ElasticSearch Input Plugin - Pipeline has terminated](https://discuss.elastic.co/t/elasticsearch-input-plugin-pipeline-has-terminated/171805)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 5:18pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-pipeline-has-terminated/171805 "2019-03-11T17:18:48Z")
Hi, I'm using ES input plugin in order to fetch data from one index, enrich/process the data and ingest the data in a new index. I found that the pipeline of the LS config using the ES plugin is started and once the qu… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=584) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=586)