# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=601 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 602 --- ## [Loop - init: logstash main process (13375) terminated with status / main process ended, respawning](https://discuss.elastic.co/t/loop-init-logstash-main-process-13375-terminated-with-status-main-process-ended-respawning/168401)
**Author:** [@Mayotte](https://discuss.elastic.co/u/Mayotte)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 11:45am UTC](https://discuss.elastic.co/t/loop-init-logstash-main-process-13375-terminated-with-status-main-process-ended-respawning/168401 "2019-02-14T11:45:23Z")
Hi All, I saw different posts here about this type of error with logstash in /var/log/messages : init: logstash main process (13375) terminated with status 1 init: logstash main process ended, respawning init: logsta… --- ## [Where is the "doc" mapping defined?](https://discuss.elastic.co/t/where-is-the-doc-mapping-defined/168053)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 3\ **Last updated:** [February 14, 2019, 10:56am UTC](https://discuss.elastic.co/t/where-is-the-doc-mapping-defined/168053 "2019-02-14T10:56:51Z")
Since 6.0 we have been using the mapping/\_type of doc in all our ES Indices. As we have now upgraded to 6.5 we want to migrate to the (almost official) \_doc mapping type. We tried this by creating a new index with the \_… --- ## [Conf file just sits and waits forever.... Windows](https://discuss.elastic.co/t/conf-file-just-sits-and-waits-forever-windows/167017)
**Author:** [@OpSecMonkey](https://discuss.elastic.co/u/OpSecMonkey)\ **Replies:** 8\ **Last updated:** [February 14, 2019, 7:52am UTC](https://discuss.elastic.co/t/conf-file-just-sits-and-waits-forever-windows/167017 "2019-02-14T07:52:18Z")
Good morning/afternoon everyone. I have recently started a fresh install with Windows 10 using 6.6.0 everything. ElasticSearch, Logstash and Kibana. I got everything working installed but I am having a issue with my co… --- ## [Strip in mutate filter](https://discuss.elastic.co/t/strip-in-mutate-filter/168167)
**Author:** [@Praneet\_Khandelwal](https://discuss.elastic.co/u/Praneet_Khandelwal)\ **Replies:** 2\ **Last updated:** [February 14, 2019, 7:20am UTC](https://discuss.elastic.co/t/strip-in-mutate-filter/168167 "2019-02-14T07:20:17Z")
I have a field in logstash \[user scp -t /apps/user\] I would like to extract the user by doing something similar to stripping off '\[' in the string. I saw that the strip option just strips off spaces. So I wanted to kno… --- ## [Filtering fields from Elasticsearch output](https://discuss.elastic.co/t/filtering-fields-from-elasticsearch-output/168327)
**Author:** [@jrandombob](https://discuss.elastic.co/u/jrandombob)\ **Replies:** 1\ **Last updated:** [February 14, 2019, 3:47am UTC](https://discuss.elastic.co/t/filtering-fields-from-elasticsearch-output/168327 "2019-02-14T03:47:35Z")
I'm working on a project which involves processing a large number of files which follow almost the same format (several billion records). I have a Grok filter working to extract the details I'm interested in, the tricky… --- ## [Hello, may i ask? can elasticsearch, logstash, kibana be installed on Windows? thank you :)](https://discuss.elastic.co/t/hello-may-i-ask-can-elasticsearch-logstash-kibana-be-installed-on-windows-thank-you/168268)
**Author:** [@diooda](https://discuss.elastic.co/u/diooda)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 10:04pm UTC](https://discuss.elastic.co/t/hello-may-i-ask-can-elasticsearch-logstash-kibana-be-installed-on-windows-thank-you/168268 "2019-02-13T22:04:17Z")
hello, may i ask? can elasticsearch, logstash, kibana be installed on Windows? thank you :slight\_smile: --- ## [Add Field With Logsstah If It Does Not Exist](https://discuss.elastic.co/t/add-field-with-logsstah-if-it-does-not-exist/168285)
**Author:** [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 8:44pm UTC](https://discuss.elastic.co/t/add-field-with-logsstah-if-it-does-not-exist/168285 "2019-02-13T20:44:30Z")
We send log data to Logstash through Winlogbeat, and we add a field to the data. fields: campus: mu We want the Logstash filter to add the field “campus” and set the value to null or unknown if the field does not exis… --- ## [Restart individual Logstash pipeline](https://discuss.elastic.co/t/restart-individual-logstash-pipeline/168100)
**Author:** [@nandrik](https://discuss.elastic.co/u/nandrik)\ **Replies:** 2\ **Last updated:** [February 13, 2019, 6:18pm UTC](https://discuss.elastic.co/t/restart-individual-logstash-pipeline/168100 "2019-02-13T18:18:45Z")
I know this question has been asked before here but with no answer. Is there a way to pass a parameter to logstash to restart only a specific pipeline without impacting the others? The reason is updated configuration o… --- ## [Filebeat issue while loading log data from api server to elasticsearch?](https://discuss.elastic.co/t/filebeat-issue-while-loading-log-data-from-api-server-to-elasticsearch/168005)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 5:35pm UTC](https://discuss.elastic.co/t/filebeat-issue-while-loading-log-data-from-api-server-to-elasticsearch/168005 "2019-02-13T17:35:09Z")
This is the issue when I'm running logstash and I need to import data from log file in api server to elasticsearch using logstash. --- ## [Reading file from beginning using file input](https://discuss.elastic.co/t/reading-file-from-beginning-using-file-input/168253)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 5\ **Last updated:** [February 13, 2019, 5:17pm UTC](https://discuss.elastic.co/t/reading-file-from-beginning-using-file-input/168253 "2019-02-13T17:17:47Z")
I have this setting, but it is not reading file again and again. I want to read this file from beginning when it is changed. I am getting this file copy from another system every one hour. It reads once when I starts … --- ## [Logstash with multiple inputs and outputs](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248)
**Author:** [@Megha\_Shree](https://discuss.elastic.co/u/Megha_Shree)\ **Replies:** 10\ **Last updated:** [February 13, 2019, 5:15pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs-and-outputs/168248 "2019-02-13T17:15:52Z")
HI All, I am trying to send rsyslog and gelf msgs from logstash to Graylog server I am getting the below error :reason=\>"Expected one of #, { at line 18, column 12 (byte 207) after output {\\n if \[type\] == "rsyslog\\ … --- ## [Logstash not importing data even after showing absolutely fine logs](https://discuss.elastic.co/t/logstash-not-importing-data-even-after-showing-absolutely-fine-logs/168073)
**Author:** [@KashiPashoria\_Tonny](https://discuss.elastic.co/u/KashiPashoria_Tonny)\ **Replies:** 4\ **Last updated:** [February 13, 2019, 4:47pm UTC](https://discuss.elastic.co/t/logstash-not-importing-data-even-after-showing-absolutely-fine-logs/168073 "2019-02-13T16:47:45Z")
I'm using elasticsearch 6.6.0 and same version of logstash to import a csv file. I wrote a config file for logstash as it should be. It shows absolutely fine logs. Ending logs are as follows: \[2019-02-12T19:52:40,089\]\[… --- ## [What is the '#' next to my field](https://discuss.elastic.co/t/what-is-the-next-to-my-field/167035)
**Author:** [@CharlieBrown](https://discuss.elastic.co/u/CharlieBrown)\ **Replies:** 3\ **Last updated:** [February 13, 2019, 4:44pm UTC](https://discuss.elastic.co/t/what-is-the-next-to-my-field/167035 "2019-02-13T16:44:38Z")
I searched google and couldnt locate any clues, I'm surprised that I am the first to ask the question. What does it mean when there's a '#' in front of my field name when most other fields have a 't' in front? Where wo… --- ## [Pipeline-pipeline communication question](https://discuss.elastic.co/t/pipeline-pipeline-communication-question/138106)
**Author:** [@rocknroll](https://discuss.elastic.co/u/rocknroll)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 4:27pm UTC](https://discuss.elastic.co/t/pipeline-pipeline-communication-question/138106 "2019-02-13T16:27:58Z")
The documentation states "If you change the ensure\_delivery flag to false, an unavailable downstream pipeline causes the sent message to be discarded. Use ensure\_delivery =\> false when you want the ability to temporarily… --- ## [Is possible to send perfdata via logstash-output-nagios\_nsca?](https://discuss.elastic.co/t/is-possible-to-send-perfdata-via-logstash-output-nagios-nsca/168256)
**Author:** [@HansM](https://discuss.elastic.co/u/HansM)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 4:21pm UTC](https://discuss.elastic.co/t/is-possible-to-send-perfdata-via-logstash-output-nagios-nsca/168256 "2019-02-13T16:21:46Z")
Hello everybody, do you know if it would be possible to send perfdata via the logstash-output-nagios\_nsca plugin? I don't find any info in the docu. Thanks! --- ## [Logstash output failed action](https://discuss.elastic.co/t/logstash-output-failed-action/168246)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 3:01pm UTC](https://discuss.elastic.co/t/logstash-output-failed-action/168246 "2019-02-13T15:01:23Z")
I am trying to merge two document based on a common information in the document. Using the doc\_as\_upsert option for this. My logstash config is if \[uri\_query\] and !\[Server\_ElapsedMS\] { elasticsearch { hosts =\> \["abcd:… --- ## [Logstash pipeline.worker default count](https://discuss.elastic.co/t/logstash-pipeline-worker-default-count/168241)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 2:47pm UTC](https://discuss.elastic.co/t/logstash-pipeline-worker-default-count/168241 "2019-02-13T14:47:53Z")
Currently we have not set any value for pipeline.worker count in logstash.yml. Elastic doc says the default value is the number of core available in the machine. My Cpu configuration is - virtual cpu count is 8 and socke… --- ## [Logstash custom pattern for grok filter](https://discuss.elastic.co/t/logstash-custom-pattern-for-grok-filter/168230)
**Author:** [@vasudevan](https://discuss.elastic.co/u/vasudevan)\ **Replies:** 2\ **Last updated:** [February 13, 2019, 1:53pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-for-grok-filter/168230 "2019-02-13T13:53:05Z")
We have a log file in which we are reading specific lines and storing it against a field for that we are using below mentioned config but it's look lengthy, repetitive and not professional but serves the purpose. I hope… --- ## [Grok parsing, still not solved](https://discuss.elastic.co/t/grok-parsing-still-not-solved/167676)
**Author:** [@heskez](https://discuss.elastic.co/u/heskez)\ **Replies:** 14\ **Last updated:** [February 13, 2019, 1:37pm UTC](https://discuss.elastic.co/t/grok-parsing-still-not-solved/167676 "2019-02-13T13:37:46Z")
Hello, I'm still struggling with the syslog parsing issue. So, my config file looks like this: input { udp { port =\> 5514 type =\> syslog } tcp { port =\> 5514 type =\> syslog } } filter { grok { … --- ## [Remove\_fields dynamic](https://discuss.elastic.co/t/remove-fields-dynamic/168058)
**Author:** [@erdo](https://discuss.elastic.co/u/erdo)\ **Replies:** 4\ **Last updated:** [February 13, 2019, 1:10pm UTC](https://discuss.elastic.co/t/remove-fields-dynamic/168058 "2019-02-13T13:10:38Z")
Is there a way to use remove\_fields as in a dynamic way for example: remove\_field =\> \["message", "\[Request\]\[Header\]", "\[Request\]\[xmlns:xsi\]", "\[Request\]\[Body\]\[q1:InvoiceQueryOpenReq… --- ## [Mutate Value to Keyname](https://discuss.elastic.co/t/mutate-value-to-keyname/168184)
**Author:** [@rebort](https://discuss.elastic.co/u/rebort)\ **Replies:** 2\ **Last updated:** [February 13, 2019, 1:04pm UTC](https://discuss.elastic.co/t/mutate-value-to-keyname/168184 "2019-02-13T13:04:35Z")
Hi, i have a Problem and i need a hint. I get this keys: { "deviceCustomString1": "segmentA", "deviceCustomString1Label": " Segment", "deviceCustomString2": "c833-cb3804056", "deviceCustomString2Label": "Policy UUI… --- ## [Logstash JDBC plugin: MySQL SET TRANSACTION ISOLATION LEVEL](https://discuss.elastic.co/t/logstash-jdbc-plugin-mysql-set-transaction-isolation-level/168220)
**Author:** [@cianchet](https://discuss.elastic.co/u/cianchet)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 12:53pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-mysql-set-transaction-isolation-level/168220 "2019-02-13T12:53:24Z")
Hello, I need to perform a query on a MySQL database. The table is very heavy and so the best way to query it is to write something like: SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED; SELECT \* FROM MYTABLE where … --- ## [SSL doesn't work when sending data from Winlogbeat to Logstash](https://discuss.elastic.co/t/ssl-doesnt-work-when-sending-data-from-winlogbeat-to-logstash/167759)
**Author:** [@elic1997](https://discuss.elastic.co/u/elic1997)\ **Replies:** 0\ **Last updated:** [February 10, 2019, 4:29pm UTC](https://discuss.elastic.co/t/ssl-doesnt-work-when-sending-data-from-winlogbeat-to-logstash/167759 "2019-02-10T16:29:02Z")
Hello, I've configured my Logstash server to accept SSL and my Winlogbeat configuration as well. Logstash configuration: input { beats { port =\> 5044 client\_inactivity\_timeout =\> 0 ssl = \> true ssl\_certificate =\>… --- ## [Configuring Centralized pipeline management for logstash](https://discuss.elastic.co/t/configuring-centralized-pipeline-management-for-logstash/168186)
**Author:** [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 11:35am UTC](https://discuss.elastic.co/t/configuring-centralized-pipeline-management-for-logstash/168186 "2019-02-13T11:35:08Z")
Hi I am trying to configure centralized pipeline management for logstash (Version 6.6.0) By referring to ELK documentation, I have made below changes: In logstash.yml xpack.monitoring.enabled: true xpack.monitoring… --- ## [Replacing @timestamp correctly](https://discuss.elastic.co/t/replacing-timestamp-correctly/166771)
**Author:** [@kelevra89](https://discuss.elastic.co/u/kelevra89)\ **Replies:** 8\ **Last updated:** [February 13, 2019, 10:52am UTC](https://discuss.elastic.co/t/replacing-timestamp-correctly/166771 "2019-02-13T10:52:09Z")
Hi there! I have a problem and hope that someone could help me with it: I try to import a file via Filebeat to Logstash to be handled there and afterwards to be indexed in Elasticsearch. So far this has worked fine! F… --- ## [Xpack logstash metrics of a DMZ server](https://discuss.elastic.co/t/xpack-logstash-metrics-of-a-dmz-server/168060)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 10:50am UTC](https://discuss.elastic.co/t/xpack-logstash-metrics-of-a-dmz-server/168060 "2019-02-13T10:50:11Z")
Hi all, I have a Server in a DMZ where logstash is installed as loglistener, which sends these logs to a rabbitmq. From our internal network, we pull these logs from the rabbitmq. As the logstash server is not allowed t… --- ## [Kafka input not working - no messages processed but offsets are updated to end](https://discuss.elastic.co/t/kafka-input-not-working-no-messages-processed-but-offsets-are-updated-to-end/168088)
**Author:** [@pvi](https://discuss.elastic.co/u/pvi)\ **Replies:** 2\ **Last updated:** [February 13, 2019, 10:26am UTC](https://discuss.elastic.co/t/kafka-input-not-working-no-messages-processed-but-offsets-are-updated-to-end/168088 "2019-02-13T10:26:44Z")
I'm running logstash 6.6.0 with kafka input in a docker image. However it is not processing any events while the consumer group offsets are updated to the latest in kafka. Even when I manually reset the offsets to the be… --- ## [ArcSight module setup failed.. kibanaclient - Error when executing Kibana client request](https://discuss.elastic.co/t/arcsight-module-setup-failed-kibanaclient-error-when-executing-kibana-client-request/168166)
**Author:** [@Hoon\_Cho](https://discuss.elastic.co/u/Hoon_Cho)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 9:01am UTC](https://discuss.elastic.co/t/arcsight-module-setup-failed-kibanaclient-error-when-executing-kibana-client-request/168166 "2019-02-13T09:01:29Z")
version : Elastic stack 6.5.4 (elasticsearch, logstash, kibana) run below setup command but kibanaclient error like this. \[root@sec-es01-dc1 ~\]# /usr/share/logstash/bin/logstash --modules arcsight --setup \\ -M "arcsigh… --- ## [Logtsash Plugin for CosmosDB to Elasticsearch](https://discuss.elastic.co/t/logtsash-plugin-for-cosmosdb-to-elasticsearch/168008)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 8:28am UTC](https://discuss.elastic.co/t/logtsash-plugin-for-cosmosdb-to-elasticsearch/168008 "2019-02-13T08:28:40Z")
Hi Team Can you please suggest which logstash plugin is used for pulling data from Cosmos DB to Elasticsearch using Logstash? If no such plug-ins, is there any other way to do the same? Thanks for your time :slight\_sm… --- ## [Logstash add field from another input](https://discuss.elastic.co/t/logstash-add-field-from-another-input/167292)
**Author:** [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\ **Replies:** 15\ **Last updated:** [February 13, 2019, 7:22am UTC](https://discuss.elastic.co/t/logstash-add-field-from-another-input/167292 "2019-02-13T07:22:48Z")
hello i have a csv file with this field "type" : "255~15674532~15724727~50195|256~41089839104~41221424128~131585024" and another csv file with 3 fields value , name , function first i used this ruby filter code to sp… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=600) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=602)