# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=598 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 599 --- ## [Logstash Dissect and mutate filter](https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042)
**Author:** [@osheap](https://discuss.elastic.co/u/osheap)\ **Replies:** 2\ **Last updated:** [February 19, 2019, 3:23pm UTC](https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042 "2019-02-19T15:23:06Z")
I am trying to strip a number of characters from a field: "192.168.0.1/12345" should become "192.168.0.1" for example. I tried to create a mutate/split filter and that sort of does something as it splits the field into … --- ## [Netflow from Cisco FTD 6.3 (Firepower)](https://discuss.elastic.co/t/netflow-from-cisco-ftd-6-3-firepower/169049)
**Author:** [@saniapa](https://discuss.elastic.co/u/saniapa)\ **Replies:** 0\ **Last updated:** [February 19, 2019, 3:18pm UTC](https://discuss.elastic.co/t/netflow-from-cisco-ftd-6-3-firepower/169049 "2019-02-19T15:18:55Z")
Hello! I use logstash-codec-netflow. I get information from Cisco ASA, ASR, switches. I'm trying to add now Cisco FTD . I see packets in tcpdump, but module keep it. who managed to collect data from Cisco FTD? --- ## [Conditional statement in logstash output doesn't work](https://discuss.elastic.co/t/conditional-statement-in-logstash-output-doesnt-work/168977)
**Author:** [@Anonymous2](https://discuss.elastic.co/u/Anonymous2)\ **Replies:** 3\ **Last updated:** [February 19, 2019, 2:45pm UTC](https://discuss.elastic.co/t/conditional-statement-in-logstash-output-doesnt-work/168977 "2019-02-19T14:45:50Z")
Hello I've made a conditional statement in the output of logstash, but the else statement doesn't work. When I send INFO logs they get into the if statement, but when I send logs different from these, they don't get into… --- ## [Can't Reload Service](https://discuss.elastic.co/t/cant-reload-service/169035)
**Author:** [@Gochou](https://discuss.elastic.co/u/Gochou)\ **Replies:** 0\ **Last updated:** [February 19, 2019, 2:08pm UTC](https://discuss.elastic.co/t/cant-reload-service/169035 "2019-02-19T14:08:04Z")
Hi, I'm using Logstash 6.4 on a Linux server. Before 6.4 I had the 2.x version and whenever I changed a config I would use the command "sudo service logstash reload" but it doesn't seem to work (exist?) anymore. Here … --- ## [Logstash refference condition](https://discuss.elastic.co/t/logstash-refference-condition/168159)
**Author:** [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\ **Replies:** 5\ **Last updated:** [February 19, 2019, 1:22pm UTC](https://discuss.elastic.co/t/logstash-refference-condition/168159 "2019-02-19T13:22:13Z")
well let me tell you my case so i can simplify everything so I have 2 csv files reference\_1.csv and reference\_2.csv plus the one I am indexing I have 2 fields test1 and test2 test1 has { "test1\_ID": "123" etc } te… --- ## [Modify json field](https://discuss.elastic.co/t/modify-json-field/168961)
**Author:** [@manasapp](https://discuss.elastic.co/u/manasapp)\ **Replies:** 11\ **Last updated:** [February 19, 2019, 12:56pm UTC](https://discuss.elastic.co/t/modify-json-field/168961 "2019-02-19T12:56:53Z")
Hi Everyone, I need to add one timestamp value to JSON. i share u code n output input { stdin{} } filter{ if (\[message\] =~ "{\\"index") { drop {} } json { source … --- ## [Issue with sqlserver data import into ES (hosted on Elastic Cloud) by using logstash jdbc input!](https://discuss.elastic.co/t/issue-with-sqlserver-data-import-into-es-hosted-on-elastic-cloud-by-using-logstash-jdbc-input/168755)
**Author:** [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Replies:** 6\ **Last updated:** [February 19, 2019, 12:44pm UTC](https://discuss.elastic.co/t/issue-with-sqlserver-data-import-into-es-hosted-on-elastic-cloud-by-using-logstash-jdbc-input/168755 "2019-02-19T12:44:38Z")
We have a project to use Elasticsearch as our analytics engine (as black box to collect data from Mariadb, SQL Server, and Cassandra ) to build reports and dashboards. I am testing the logstash and jdbc input plugin to s… --- ## [Index JSON data from kafka to elatsicsearch](https://discuss.elastic.co/t/index-json-data-from-kafka-to-elatsicsearch/168990)
**Author:** [@B123](https://discuss.elastic.co/u/B123)\ **Replies:** 0\ **Last updated:** [February 19, 2019, 10:14am UTC](https://discuss.elastic.co/t/index-json-data-from-kafka-to-elatsicsearch/168990 "2019-02-19T10:14:50Z")
Hi, I am trying to index JSON data from KAFKA to elasticsearch using a logstash pipeline. The JSON data is indexed in KAFKA cluster as a single message . How do i exactly parse it and store the JSON data in an index. --- ## [Logstash synchronize mysql data to elastic](https://discuss.elastic.co/t/logstash-synchronize-mysql-data-to-elastic/168976)
**Author:** [@Zoomtoo](https://discuss.elastic.co/u/Zoomtoo)\ **Replies:** 0\ **Last updated:** [February 19, 2019, 9:26am UTC](https://discuss.elastic.co/t/logstash-synchronize-mysql-data-to-elastic/168976 "2019-02-19T09:26:37Z")
Hello experts: My software version (es-6.5.1, logstash-6.5.1, mysql5.7) Recently, I encountered a problem when using logstash to synchronize mysql data to elastic. Synchronize data from the same library in mysql. After… --- ## [\\MySQL\\Connector was unexpected at this time](https://discuss.elastic.co/t/mysql-connector-was-unexpected-at-this-time/168590)
**Author:** [@Defopmans](https://discuss.elastic.co/u/Defopmans)\ **Replies:** 1\ **Last updated:** [February 19, 2019, 9:18am UTC](https://discuss.elastic.co/t/mysql-connector-was-unexpected-at-this-time/168590 "2019-02-19T09:18:32Z")
Im experimenting with logstash, but I can't seem to get it running. As soon as i run next line from cmd: logstash -e input { stdin { } } output { stdout {} } i get: \\MySQL\\Connector was unexpected at this time. Any … --- ## [\[AGGREGATE\] - aggregate is working but single rows are sent to elastic too](https://discuss.elastic.co/t/aggregate-aggregate-is-working-but-single-rows-are-sent-to-elastic-too/168880)
**Author:** [@stestaz](https://discuss.elastic.co/u/stestaz)\ **Replies:** 5\ **Last updated:** [February 19, 2019, 8:40am UTC](https://discuss.elastic.co/t/aggregate-aggregate-is-working-but-single-rows-are-sent-to-elastic-too/168880 "2019-02-19T08:40:56Z")
Hi, I'm trying to get some exchange log to elastic using Logstash, I've tried some configuration and found something that is working but if I remove the event.cancel() in all the if conditions all rows are sent to elasti… --- ## [How to fetch record count between two date range using logstash filter](https://discuss.elastic.co/t/how-to-fetch-record-count-between-two-date-range-using-logstash-filter/168953)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 0\ **Last updated:** [February 19, 2019, 7:29am UTC](https://discuss.elastic.co/t/how-to-fetch-record-count-between-two-date-range-using-logstash-filter/168953 "2019-02-19T07:29:05Z")
I am using elastic search as my input in my input, I am reading one index and my output is email I want to send a mail on a daily basis record count between two @timestamp from time 00:00 to 24:00 I tried ruby filter… --- ## [Logstash 6.4 use beats input plugin to collect large log file, but too slow](https://discuss.elastic.co/t/logstash-6-4-use-beats-input-plugin-to-collect-large-log-file-but-too-slow/166898)
**Author:** [@PriestTomb](https://discuss.elastic.co/u/PriestTomb)\ **Replies:** 1\ **Last updated:** [February 19, 2019, 5:35am UTC](https://discuss.elastic.co/t/logstash-6-4-use-beats-input-plugin-to-collect-large-log-file-but-too-slow/166898 "2019-02-19T05:35:50Z")
Hello, I use Logstash 6.4 and Filebeat 6.4 to collect large log file(just a test), not the whole file is large, but that each line is large, like 10KB a line. When a line of logs is only 1KB in size, the test results a… --- ## [Fail to start and recive log on ELK](https://discuss.elastic.co/t/fail-to-start-and-recive-log-on-elk/168917)
**Author:** [@tranthanhduy1992](https://discuss.elastic.co/u/tranthanhduy1992)\ **Replies:** 1\ **Last updated:** [February 19, 2019, 3:07am UTC](https://discuss.elastic.co/t/fail-to-start-and-recive-log-on-elk/168917 "2019-02-19T03:07:13Z")
Hi everyone! Please help me about my ELK. It can't listen on port 514. This problem is on capture. --- ## [Getting error for sincedb\_path in window 7](https://discuss.elastic.co/t/getting-error-for-sincedb-path-in-window-7/168905)
**Author:** [@anujjai](https://discuss.elastic.co/u/anujjai)\ **Replies:** 4\ **Last updated:** [February 19, 2019, 12:27am UTC](https://discuss.elastic.co/t/getting-error-for-sincedb-path-in-window-7/168905 "2019-02-19T00:27:32Z")
HI , My config is below input { file { path =\> "C:/Anuj/ElasticSearch/DMS\_GTX-Process\_Archive.log" start\_position =\> "beginning" sincedb\_path =\> "C:/dev/null/logdbpath.txt" sincedb\_write\_interval =\> 10 } } filt… --- ## [Monitoring of logstash not working in elasticsearch/kibana](https://discuss.elastic.co/t/monitoring-of-logstash-not-working-in-elasticsearch-kibana/168781)
**Author:** [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\ **Replies:** 0\ **Last updated:** [February 18, 2019, 8:26am UTC](https://discuss.elastic.co/t/monitoring-of-logstash-not-working-in-elasticsearch-kibana/168781 "2019-02-18T08:26:39Z")
Hi All, Pretty new to ELK and I trying to get Logstash to send moniting data so it is available in the Kibana monitoring dashboard. As you can see I have been able to colelct Elasticsearch, Kibana, Filebeat and Winlogb… --- ## [Logstash service restarts constantly and does send data to elasticsearch](https://discuss.elastic.co/t/logstash-service-restarts-constantly-and-does-send-data-to-elasticsearch/168662)
**Author:** [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\ **Replies:** 2\ **Last updated:** [February 18, 2019, 8:49pm UTC](https://discuss.elastic.co/t/logstash-service-restarts-constantly-and-does-send-data-to-elasticsearch/168662 "2019-02-18T20:49:43Z")
I have a problem with the Logstash service constantly restarting and never sending data elasticsearch. There must be a bad config or a file missing in a location that it is set to read on startup. If I run manually, Logs… --- ## [Cannot load Java class org.apache.http.client.methods.HttpRequestBase](https://discuss.elastic.co/t/cannot-load-java-class-org-apache-http-client-methods-httprequestbase/168887)
**Author:** [@eddie22](https://discuss.elastic.co/u/eddie22)\ **Replies:** 0\ **Last updated:** [February 18, 2019, 6:36pm UTC](https://discuss.elastic.co/t/cannot-load-java-class-org-apache-http-client-methods-httprequestbase/168887 "2019-02-18T18:36:15Z")
Having trouble getting Logstash to run correctly on my Mac. I get this error no matter that I do with configuration file. I get this on 6.5.4 and 6.6.0. cannot load Java class org.apache.http.client.methods.HttpReques… --- ## [Simple Grok and Date filter problem](https://discuss.elastic.co/t/simple-grok-and-date-filter-problem/168867)
**Author:** [@Tim3](https://discuss.elastic.co/u/Tim3)\ **Replies:** 4\ **Last updated:** [February 18, 2019, 5:03pm UTC](https://discuss.elastic.co/t/simple-grok-and-date-filter-problem/168867 "2019-02-18T17:03:46Z")
Hello, I recently tried to use ElasticSearch and Logstash, and I'm currently trying to get few fields from this log line : 2018-12-05 00:13:45,000 LogType - MachineNumber Message I use this filter : filter { grok { … --- ## [How can I delete changing rows?](https://discuss.elastic.co/t/how-can-i-delete-changing-rows/168877)
**Author:** [@alchimia](https://discuss.elastic.co/u/alchimia)\ **Replies:** 0\ **Last updated:** [February 18, 2019, 4:51pm UTC](https://discuss.elastic.co/t/how-can-i-delete-changing-rows/168877 "2019-02-18T16:51:22Z")
Hi, I have some rows I need to insert and after to update or delete if they change. I think I should use an upsert but I don't know how to. I have: request number (key) request status (number) If the request is statu… --- ## [Sending azure\_event\_hub messages to elasticsearch](https://discuss.elastic.co/t/sending-azure-event-hub-messages-to-elasticsearch/167550)
**Author:** [@fringeadmin](https://discuss.elastic.co/u/fringeadmin)\ **Replies:** 6\ **Last updated:** [February 18, 2019, 4:33pm UTC](https://discuss.elastic.co/t/sending-azure-event-hub-messages-to-elasticsearch/167550 "2019-02-18T16:33:42Z")
I recently installed Elastic Stack for the first time using the steps at Digital Ocean. I then followed the steps at the Azure Event Hubs plugin page to link logstash to an Azure event hub. This seemed to go okay, but no… --- ## [Input File Path ignores directories and gathering all the files](https://discuss.elastic.co/t/input-file-path-ignores-directories-and-gathering-all-the-files/168853)
**Author:** [@torny](https://discuss.elastic.co/u/torny)\ **Replies:** 2\ **Last updated:** [February 18, 2019, 4:20pm UTC](https://discuss.elastic.co/t/input-file-path-ignores-directories-and-gathering-all-the-files/168853 "2019-02-18T16:20:56Z")
Hello, I have a problem with Input -\> File plugin. On a fresh install I created index of bunch of csv files located in one directory. Works fine. Then I made neighboring directory with other csv files set. Made new co… --- ## [Converting to integer nested fields with ruby plugin](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835)
**Author:** [@pastechecker](https://discuss.elastic.co/u/pastechecker)\ **Replies:** 4\ **Last updated:** [February 18, 2019, 3:20pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835 "2019-02-18T15:20:39Z")
Hello. I am attempting to convert to field type integer certain fields in my json. { "user\_email": "example@com", "user\_id": "8ca5c5b4119b5d9c1b95d9e2af7e4702", "path": "/tmp/mystuff.json", "type": "json", "stati… --- ## [Setting Logstash to run as a service and start on reboot](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353)
**Author:** [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\ **Replies:** 7\ **Last updated:** [February 18, 2019, 1:52pm UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353 "2019-02-18T13:52:00Z")
When I log out of an interactive terminal Filebeat and Logstash seem to run in the foreground and stop. Elasticsearch and Kibana services are running OK. This just might be that my Linux fu is not up to scratch but how … --- ## [Pasring Json file](https://discuss.elastic.co/t/pasring-json-file/168826)
**Author:** [@neo](https://discuss.elastic.co/u/neo)\ **Replies:** 3\ **Last updated:** [February 18, 2019, 1:23pm UTC](https://discuss.elastic.co/t/pasring-json-file/168826 "2019-02-18T13:23:05Z")
Hi All, I'm trying to parse json file but I'm getting error and incorrect result the log file look like this: { "Records": \[{ "EventVersion": "1.0", "EventSubscriptionArn": "XXX", "EventSource": "XXX", "Sns": { … --- ## [Initialize variable in Logstash ruby](https://discuss.elastic.co/t/initialize-variable-in-logstash-ruby/166950)
**Author:** [@pastechecker](https://discuss.elastic.co/u/pastechecker)\ **Replies:** 2\ **Last updated:** [February 18, 2019, 1:16pm UTC](https://discuss.elastic.co/t/initialize-variable-in-logstash-ruby/166950 "2019-02-18T13:16:45Z")
Hello. I have my pipeline configured as follows: ... mutate { add\_field =\> { "append\_request\_history\_array" =\> \[ "%{time\_local}, host:%{host}, request\_uri:%{request\_uri}, user\_agent:%{user\_agent}\] } … --- ## [Logstash parse docker container log](https://discuss.elastic.co/t/logstash-parse-docker-container-log/168816)
**Author:** [@messi655](https://discuss.elastic.co/u/messi655)\ **Replies:** 1\ **Last updated:** [February 18, 2019, 1:16pm UTC](https://discuss.elastic.co/t/logstash-parse-docker-container-log/168816 "2019-02-18T13:16:38Z")
Hi, Our API is running by container and the log of our API inside container have format like this: {"log":"{"fields.time":"2019-02-16T02:53:00.606890428Z","ip":"xx.xxx.xxx.xxx","latency":303805427,"level":"info","meth… --- ## [Logstash cant push to elasticsearch if cluster is yellow](https://discuss.elastic.co/t/logstash-cant-push-to-elasticsearch-if-cluster-is-yellow/168804)
**Author:** [@christianVLC](https://discuss.elastic.co/u/christianVLC)\ **Replies:** 4\ **Last updated:** [February 18, 2019, 12:36pm UTC](https://discuss.elastic.co/t/logstash-cant-push-to-elasticsearch-if-cluster-is-yellow/168804 "2019-02-18T12:36:27Z")
Hi all, We have one Redis-Logstash-Elasticsearch installation and when elasticsearch is yellow (for example while its doing colocation/re-sharding after one node restart), then Logstash cant push to Elasticsearh. Is th… --- ## [Grok Pattern with If Condtion](https://discuss.elastic.co/t/grok-pattern-with-if-condtion/168777)
**Author:** [@Jaideep](https://discuss.elastic.co/u/Jaideep)\ **Replies:** 1\ **Last updated:** [February 18, 2019, 12:31pm UTC](https://discuss.elastic.co/t/grok-pattern-with-if-condtion/168777 "2019-02-18T12:31:12Z")
Hi I am new to logstash.I am using grok filter based on condition.For example if Network contains in message then do following match and if security contain in message then do some other match.I have written following c… --- ## [When application's losing logsash connection](https://discuss.elastic.co/t/when-applications-losing-logsash-connection/168789)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 1\ **Last updated:** [February 18, 2019, 12:24pm UTC](https://discuss.elastic.co/t/when-applications-losing-logsash-connection/168789 "2019-02-18T12:24:37Z")
hi there let me subscribe my scenario first. i ship app logs using log4net SocketAppender via TCP to logstash svc. here, sometimes i need to restart logstash service if my config has some changes. in that time, appli… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=597) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=599)