# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=587 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 588 --- ## [Logstash monitoring security setup](https://discuss.elastic.co/t/logstash-monitoring-security-setup/171533)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 4\ **Last updated:** [March 8, 2019, 5:52pm UTC](https://discuss.elastic.co/t/logstash-monitoring-security-setup/171533 "2019-03-08T17:52:27Z")
We're trying to learn how to setup TLS on elastic. We have a 1 node stack with version 6.6.1, working on getting logstash setup. All output is in pipelines. Getting this error at startup: \[WARN \]\[logstash.outputs.el… --- ## [Duplicate entries when using jdbc pipeline](https://discuss.elastic.co/t/duplicate-entries-when-using-jdbc-pipeline/171529)
**Author:** [@annk](https://discuss.elastic.co/u/annk)\ **Replies:** 4\ **Last updated:** [March 8, 2019, 5:45pm UTC](https://discuss.elastic.co/t/duplicate-entries-when-using-jdbc-pipeline/171529 "2019-03-08T17:45:30Z")
Hi, I am getting duplicate entries when I use my jdbc pipeline below: input { jdbc{ jdbc\_driver\_library =\> "/opt/jdbcjars/mariadb-java-client-2.3.0.jar" jdbc\_driver\_class =\> "org.mariadb.jdbc.Driver" jdbc\_connecti… --- ## [AMA: Java plugins in Logstash](https://discuss.elastic.co/t/ama-java-plugins-in-logstash/171535)
**Author:** [@danhermann](https://discuss.elastic.co/u/danhermann)\ **Replies:** 0\ **Last updated:** [March 8, 2019, 5:13pm UTC](https://discuss.elastic.co/t/ama-java-plugins-in-logstash/171535 "2019-03-08T17:13:48Z")
In case you haven't seen it, we've added experimental support for pure Java plugins in Logstash. We're promoting it to a beta feature in the upcoming Logstash 6.7 release with plans to move to GA shortly after that. I k… --- ## [Filter in java](https://discuss.elastic.co/t/filter-in-java/171483)
**Author:** [@icaroboanova](https://discuss.elastic.co/u/icaroboanova)\ **Replies:** 1\ **Last updated:** [March 8, 2019, 5:07pm UTC](https://discuss.elastic.co/t/filter-in-java/171483 "2019-03-08T17:07:39Z")
how do import csv data with java filter or read a java document from the filter --- ## [Parse string to timestamp in csv](https://discuss.elastic.co/t/parse-string-to-timestamp-in-csv/171408)
**Author:** [@scorpioy1](https://discuss.elastic.co/u/scorpioy1)\ **Replies:** 9\ **Last updated:** [March 8, 2019, 4:43pm UTC](https://discuss.elastic.co/t/parse-string-to-timestamp-in-csv/171408 "2019-03-08T16:43:30Z")
Hi, I'm trying to parse the 1st column of line in csv to be a timestamp column. But elasticsearch is still treating it as string, not a timestamp. Please help. filter { csv { columns =\> \["nowdatetime","Total\_sum","DIF… --- ## [Multiple merges in one mutate causes override](https://discuss.elastic.co/t/multiple-merges-in-one-mutate-causes-override/171525)
**Author:** [@tacomaster](https://discuss.elastic.co/u/tacomaster)\ **Replies:** 1\ **Last updated:** [March 8, 2019, 4:36pm UTC](https://discuss.elastic.co/t/multiple-merges-in-one-mutate-causes-override/171525 "2019-03-08T16:36:43Z")
Hi, Having multiple merge settings in a mutate appears to only keep the last merge. mutate { add\_field =\> {"\[array\_field\]" =\> \[\]} merge =\> {"\[array\_field\]"=\> "\[field\_1\]"} merge =\> {"\[array\_field\]"=\> "\[field… --- ## [Error while trying to set up Arch Sight Module in logstash](https://discuss.elastic.co/t/error-while-trying-to-set-up-arch-sight-module-in-logstash/170659)
**Author:** [@rajatdey80](https://discuss.elastic.co/u/rajatdey80)\ **Replies:** 6\ **Last updated:** [March 8, 2019, 1:42pm UTC](https://discuss.elastic.co/t/error-while-trying-to-set-up-arch-sight-module-in-logstash/170659 "2019-03-08T13:42:16Z")
While setting Up Archsight ./logstash --modules arcsight --setup -M "arcsight.var.input.smartconnector.port=5602" -M "arcsight.var.elasticsearch.hosts=10.1.20.96:9200" -M "arcsight.var.kibana.host=10.1.20.96:5601" Th… --- ## [Resolved - Logstash - CSV parse failure for some records](https://discuss.elastic.co/t/resolved-logstash-csv-parse-failure-for-some-records/170842)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 6\ **Last updated:** [March 8, 2019, 1:32pm UTC](https://discuss.elastic.co/t/resolved-logstash-csv-parse-failure-for-some-records/170842 "2019-03-08T13:32:38Z")
Hi Team, I have a huge csv file exported from github which is the commit information of engineers. In the csv, there're two columns (COMMIT\_COMMENT and JIRA\_KEY) might contain special characters, but unlikely I am not a… --- ## [Logstash tags conditional issue](https://discuss.elastic.co/t/logstash-tags-conditional-issue/171349)
**Author:** [@a.sailor](https://discuss.elastic.co/u/a.sailor)\ **Replies:** 3\ **Last updated:** [March 8, 2019, 1:02pm UTC](https://discuss.elastic.co/t/logstash-tags-conditional-issue/171349 "2019-03-08T13:02:23Z")
Hi all, i'm trying to accomplish one very simple thing, but i'm now stuck. This is my basic logstash pipeline: input { beats { port =\> 5044 } } ### FILTER SECTION ### filter { if "cms-access" in \[tags\] { grok { m… --- ## [Resolved - Need Help for the error “Invalid format: “11/19/2014” is malformed at “/19/2014”" in elasticsearch](https://discuss.elastic.co/t/resolved-need-help-for-the-error-invalid-format-11-19-2014-is-malformed-at-19-2014-in-elasticsearch/171484)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 1\ **Last updated:** [March 8, 2019, 1:01pm UTC](https://discuss.elastic.co/t/resolved-need-help-for-the-error-invalid-format-11-19-2014-is-malformed-at-19-2014-in-elasticsearch/171484 "2019-03-08T13:01:56Z")
Hi Team, I am facing an error related with date in elasticsearch. Below is the detail information, can you please help advice what's the problem? I googled this issue and there is do similar issue, but tried many times… --- ## [How to "tail" an ElasticSearch index in LogStash](https://discuss.elastic.co/t/how-to-tail-an-elasticsearch-index-in-logstash/171488)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [March 8, 2019, 12:31pm UTC](https://discuss.elastic.co/t/how-to-tail-an-elasticsearch-index-in-logstash/171488 "2019-03-08T12:31:05Z")
We have all our logfile entries in a logs-\* index and would like to tail it, choosing some special/error entries to push into another index issues-\*. How can we query ElasticSearch for all logs.\* since time X where X i… --- ## [Grok Filter only parses the first event matching the pattern](https://discuss.elastic.co/t/grok-filter-only-parses-the-first-event-matching-the-pattern/171492)
**Author:** [@Vijay\_Khadia](https://discuss.elastic.co/u/Vijay_Khadia)\ **Replies:** 0\ **Last updated:** [March 8, 2019, 12:27pm UTC](https://discuss.elastic.co/t/grok-filter-only-parses-the-first-event-matching-the-pattern/171492 "2019-03-08T12:27:21Z")
Hi, For a requirement I created grok pattern to parse the log contents. When I run the logstash it matches the first occurence of the pattern and displays the output. If once again I copy-paste the log that matches the … --- ## [Failed to execute action error on windows](https://discuss.elastic.co/t/failed-to-execute-action-error-on-windows/171320)
**Author:** [@spolat](https://discuss.elastic.co/u/spolat)\ **Replies:** 2\ **Last updated:** [March 7, 2019, 6:03pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-error-on-windows/171320 "2019-03-07T18:03:11Z")
Logstash version 6.6.1 Operating system : windows 10 conf file : input { generator {} } filter { sleep { time =\> 1 } } output { stdout { codec =\> json } } pipelines.yml : pipeline.id: main ERROR Message \] Executing… --- ## [Logstash could not connet to influxdb](https://discuss.elastic.co/t/logstash-could-not-connet-to-influxdb/171481)
**Author:** [@lina.sun](https://discuss.elastic.co/u/lina.sun)\ **Replies:** 0\ **Last updated:** [March 8, 2019, 11:26am UTC](https://discuss.elastic.co/t/logstash-could-not-connet-to-influxdb/171481 "2019-03-08T11:26:06Z")
i want to use UDP port to write metric to influxdb. when i use 8086 ,it Operating normally。but when i change the port to 8089 .It Will report an error. my logstash config: influxdb config: \[\[udp\]\] enabled = true … --- ## [Pipeline.yml - Use of parameters for conf input](https://discuss.elastic.co/t/pipeline-yml-use-of-parameters-for-conf-input/171466)
**Author:** [@romariol](https://discuss.elastic.co/u/romariol)\ **Replies:** 0\ **Last updated:** [March 8, 2019, 9:59am UTC](https://discuss.elastic.co/t/pipeline-yml-use-of-parameters-for-conf-input/171466 "2019-03-08T09:59:36Z")
Hello, I'm using the pipeline.yml to run multiple configurations at the same time. Basically each and every config file are performing a soap call (where the date is today), filter the data and upsert the data in ES. Ho… --- ## [Unseen monitor of logstash in kibana's monitor UI](https://discuss.elastic.co/t/unseen-monitor-of-logstash-in-kibanas-monitor-ui/170724)
**Author:** [@Walter\_Xue1](https://discuss.elastic.co/u/Walter_Xue1)\ **Replies:** 4\ **Last updated:** [March 8, 2019, 9:33am UTC](https://discuss.elastic.co/t/unseen-monitor-of-logstash-in-kibanas-monitor-ui/170724 "2019-03-08T09:33:47Z")
Version 6.3.2 I configure x-pack in logstash , but unseen monitor of logstash in kibana's monitor UI logstash.yml xpack.monitoring.collection.enabled: true xpack.monitoring.enabled: true xpack.monitoring.elasticsea… --- ## [Logstash match pattern then send email](https://discuss.elastic.co/t/logstash-match-pattern-then-send-email/171302)
**Author:** [@ognjen011](https://discuss.elastic.co/u/ognjen011)\ **Replies:** 0\ **Last updated:** [March 7, 2019, 12:32pm UTC](https://discuss.elastic.co/t/logstash-match-pattern-then-send-email/171302 "2019-03-07T12:32:06Z")
This was never answered so i removed it --- ## [How can split the log data source separete by , in that result field i need to split multiple field](https://discuss.elastic.co/t/how-can-split-the-log-data-source-separete-by-in-that-result-field-i-need-to-split-multiple-field/171436)
**Author:** [@muralasandeep](https://discuss.elastic.co/u/muralasandeep)\ **Replies:** 0\ **Last updated:** [March 8, 2019, 6:35am UTC](https://discuss.elastic.co/t/how-can-split-the-log-data-source-separete-by-in-that-result-field-i-need-to-split-multiple-field/171436 "2019-03-08T06:35:45Z")
Hi Every one, This is Sandeep , My data source is like this (1st row ) "1102417","2018-11-01 02:00:02","ERROR","QUERY-\> update emp set statues='No-Show' where DATE\_FORMAT(tpam\_app\_start\_epoch,'%Y-%m-%d') \< (CURDATE() … --- ## [Hyphen in SEMANTIC not supported](https://discuss.elastic.co/t/hyphen-in-semantic-not-supported/171426)
**Author:** [@shubhamblackstratus](https://discuss.elastic.co/u/shubhamblackstratus)\ **Replies:** 0\ **Last updated:** [March 8, 2019, 5:30am UTC](https://discuss.elastic.co/t/hyphen-in-semantic-not-supported/171426 "2019-03-08T05:30:11Z")
I am having a log and its partial GROK part is here. %{WORD:Shoes-type}. While Parsing this, I found that only Shoes in parsed instead of Shoes-type. Find the Result. { "Shoes": \[ \[ "Leather" \] \] } Please help… --- ## [Squid logs (access logs)](https://discuss.elastic.co/t/squid-logs-access-logs/171274)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 2\ **Last updated:** [March 8, 2019, 4:15am UTC](https://discuss.elastic.co/t/squid-logs-access-logs/171274 "2019-03-08T04:15:49Z")
I am trying to create index for a squid log....although the filebeat creates the pipeline for logstash but due to some error in my grok I am not able to segregate the logs..P.S help me.. sample of my log file: " 55172… --- ## [Logstash problem with Elasticsearch](https://discuss.elastic.co/t/logstash-problem-with-elasticsearch/111795)
**Author:** [@Judin](https://discuss.elastic.co/u/Judin)\ **Replies:** 4\ **Last updated:** [March 8, 2019, 4:03am UTC](https://discuss.elastic.co/t/logstash-problem-with-elasticsearch/111795 "2019-03-08T04:03:58Z")
Hi, First I appologize for my english it's not my first langage. I did not find a similar post about my issue that's why i'm creating a new one. I have a test environnement composed by Elasticsearch, Logstash, Kibana … --- ## [Reference key from kv filter to use in date filter](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389)
**Author:** [@Jeba\_Bhaskaran](https://discuss.elastic.co/u/Jeba_Bhaskaran)\ **Replies:** 5\ **Last updated:** [March 8, 2019, 1:36am UTC](https://discuss.elastic.co/t/reference-key-from-kv-filter-to-use-in-date-filter/171389 "2019-03-08T01:36:29Z")
Hello, I am using a kv filter to split text and then need to use a field from the split text as @timestamp. Here is filter snippet from from my config file filter { kv { } date { match =\> \["%{start}", "UNIX"\] targe… --- ## [Error parsing csv field message](https://discuss.elastic.co/t/error-parsing-csv-field-message/171360)
**Author:** [@drivera](https://discuss.elastic.co/u/drivera)\ **Replies:** 5\ **Last updated:** [March 7, 2019, 9:06pm UTC](https://discuss.elastic.co/t/error-parsing-csv-field-message/171360 "2019-03-07T21:06:41Z")
Recently upgraded to LS 5.6.15 and began receiving the error below. Is this a break in this version of LS? Do you see anything wrong with my config? Thanks. Error message: \[logstash.filters.csv \] Error parsing csv … --- ## [Mutate Split unable to get variables](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372)
**Author:** [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Replies:** 4\ **Last updated:** [March 7, 2019, 7:58pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372 "2019-03-07T19:58:04Z")
Logstash version 6.6.1 I am attempting to split out the \[path\] to get the file name. Not all of my logs have extensions, so I am attempting to split things by the / rather than the grok example that I found with the ".l… --- ## [Does logstash6.4.0 support writing to nfs output](https://discuss.elastic.co/t/does-logstash6-4-0-support-writing-to-nfs-output/171378)
**Author:** [@simson](https://discuss.elastic.co/u/simson)\ **Replies:** 0\ **Last updated:** [March 7, 2019, 7:19pm UTC](https://discuss.elastic.co/t/does-logstash6-4-0-support-writing-to-nfs-output/171378 "2019-03-07T19:19:12Z")
Hi, I was trying to have multipel logstash process write to a logfile mounted via NFS. I was getting null characters on my file as it was getting added through the buffer. I see the following in release notes of logsta… --- ## [Logstash doesn't parse messages and doesn't add \_grokparsefailure tag](https://discuss.elastic.co/t/logstash-doesnt-parse-messages-and-doesnt-add-grokparsefailure-tag/171140)
**Author:** [@antonro](https://discuss.elastic.co/u/antonro)\ **Replies:** 0\ **Last updated:** [March 6, 2019, 3:02pm UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-messages-and-doesnt-add-grokparsefailure-tag/171140 "2019-03-06T15:02:08Z")
Hi all, I am running 3 logstash instances in AWS EC2 with shared configuration (shared via AWS EFS) to balance load between them. Logs are sent by filebeat from the number of hosts. I've created new logstash pipeline t… --- ## [Split logstash config into multiple files](https://discuss.elastic.co/t/split-logstash-config-into-multiple-files/171166)
**Author:** [@richbai90](https://discuss.elastic.co/u/richbai90)\ **Replies:** 1\ **Last updated:** [March 7, 2019, 4:46pm UTC](https://discuss.elastic.co/t/split-logstash-config-into-multiple-files/171166 "2019-03-07T16:46:07Z")
I am just learning elasticsearch and I need to know how to correctly split a configuration file into multiple. I'm using the official logstash on docker with ports bound on 9600 and 5044. Originally I had a working singl… --- ## [Change pipeline workers at runtime?](https://discuss.elastic.co/t/change-pipeline-workers-at-runtime/171345)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [March 7, 2019, 4:06pm UTC](https://discuss.elastic.co/t/change-pipeline-workers-at-runtime/171345 "2019-03-07T16:06:41Z")
Hi, in pipeline configuration I have configured: pipeline.workers: 2 Is it possible to change this configuration at runtime? It does not need to be persistent. Thanks, Andreas --- ## [Grok a multi format log file - custom app](https://discuss.elastic.co/t/grok-a-multi-format-log-file-custom-app/171310)
**Author:** [@octav\_a](https://discuss.elastic.co/u/octav_a)\ **Replies:** 1\ **Last updated:** [March 7, 2019, 4:02pm UTC](https://discuss.elastic.co/t/grok-a-multi-format-log-file-custom-app/171310 "2019-03-07T16:02:21Z")
Hi there, So I have a custom application with a log file that have multiple type of lines, normal syslog and also json. It looks like this: 2019-03-07T11:29:52+0000 | 10.0.0.0 | \[3rdParty\] xxxxxxxxxxxx || INFO | R… --- ## [Single file multiple log entries](https://discuss.elastic.co/t/single-file-multiple-log-entries/171304)
**Author:** [@oceanvijai](https://discuss.elastic.co/u/oceanvijai)\ **Replies:** 1\ **Last updated:** [March 7, 2019, 3:48pm UTC](https://discuss.elastic.co/t/single-file-multiple-log-entries/171304 "2019-03-07T15:48:51Z")
Hi, Lets say I have a single log file with heterogeneous entries like this .... \[time\] methodName parameter1 parameter2 parameter3 .... \[time\] networkCall 200 4000 ..... \[time\] methodName parameter1 parameter2 par… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=586) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=588)