# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=610 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 611 --- ## [Gelf input over SSL](https://discuss.elastic.co/t/gelf-input-over-ssl/166132)
**Author:** [@eirisdg](https://discuss.elastic.co/u/eirisdg)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 1:25pm UTC](https://discuss.elastic.co/t/gelf-input-over-ssl/166132 "2019-01-29T13:25:43Z")
Hello. I'm trying to configure Logstash with Gelf input over SSL. Is it possible? The documentation about it is not clear and in my sender I see that I can use SSL over TCP, but can't find how to configure the input in… --- ## [Ambiguous in documentation which describe logstash filter plugin "mutate -\> split"](https://discuss.elastic.co/t/ambiguous-in-documentation-which-describe-logstash-filter-plugin-mutate-split/166086)
**Author:** [@royoan](https://discuss.elastic.co/u/royoan)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 1:21pm UTC](https://discuss.elastic.co/t/ambiguous-in-documentation-which-describe-logstash-filter-plugin-mutate-split/166086 "2019-01-29T13:21:27Z")
In the page : https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split In the "Describtion" section,it show the field "split" type as an array. filter { mutate { spli… --- ## [Could not recognize 'ssl\_key' format](https://discuss.elastic.co/t/could-not-recognize-ssl-key-format/166163)
**Author:** [@lyubava](https://discuss.elastic.co/u/lyubava)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 1:16pm UTC](https://discuss.elastic.co/t/could-not-recognize-ssl-key-format/166163 "2019-01-29T13:16:05Z")
Hi, I'm trying to implement SSL in TCP input. And I have error: "Could not recognize 'ssl\_key' format. Class: Java::OrgBouncycastleCert::X509CertificateHolder", :thread=\>"#\" There is part of my… --- ## [Mapper\_parsing\_exception & illegal\_argument\_exception](https://discuss.elastic.co/t/mapper-parsing-exception-illegal-argument-exception/166083)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 1:13pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-illegal-argument-exception/166083 "2019-01-29T13:13:20Z")
Hello World! I've noticed following WARN message in my logstash's output: logstash | \[2019-01-29T04:39:23,166\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=>400, :action=&g… --- ## [Logstash rpm service on unix](https://discuss.elastic.co/t/logstash-rpm-service-on-unix/165746)
**Author:** [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 12:39pm UTC](https://discuss.elastic.co/t/logstash-rpm-service-on-unix/165746 "2019-01-29T12:39:19Z")
okay i was running logstash on unix using the /bin logstash comman but it gives the warning that it cant find the logstash.yml when it already exists so i found out that i should run it as a service so i did that and the… --- ## [Logstash 6.4.2 High CPU usage while running a conf file](https://discuss.elastic.co/t/logstash-6-4-2-high-cpu-usage-while-running-a-conf-file/166161)
**Author:** [@bharatbhushan](https://discuss.elastic.co/u/bharatbhushan)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 12:26pm UTC](https://discuss.elastic.co/t/logstash-6-4-2-high-cpu-usage-while-running-a-conf-file/166161 "2019-01-29T12:26:46Z")
Hi All, i am running single Logstash conf file with simple code. but every times cpu is reached to full usage ( all cpu is upto 100%). While starting Logstash conf file, Cpu is increasing. Conf file is below menti… --- ## [Urldecode error](https://discuss.elastic.co/t/urldecode-error/166147)
**Author:** [@jmkim](https://discuss.elastic.co/u/jmkim)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 12:09pm UTC](https://discuss.elastic.co/t/urldecode-error/166147 "2019-01-29T12:09:48Z")
Hi, everyone! I can not encode with utf-8. logstash filter: urldecode { field =\> "kw\_nm" } ruby { code =\> " kw\_nm = event.get('kw\_nm') kw\_nm.force\_encoding('ISO-8859-1').encode('UTF-8') event.set('enc\_kw\_nm', kw… --- ## [Logstash unable to upload csv](https://discuss.elastic.co/t/logstash-unable-to-upload-csv/166103)
**Author:** [@examin](https://discuss.elastic.co/u/examin)\ **Replies:** 3\ **Last updated:** [January 29, 2019, 11:51am UTC](https://discuss.elastic.co/t/logstash-unable-to-upload-csv/166103 "2019-01-29T11:51:18Z")
I am trying to add index to ElasticSearch from a csv using logstash. my config file : input { file{ path =\> "C:\\Users\\Administrator\\Downloads\\8THJAN210.csv" start\_position =\> "beginning" sincedb\_path =\>"C:\\U… --- ## [0365 Unified Audit csv log](https://discuss.elastic.co/t/0365-unified-audit-csv-log/166155)
**Author:** [@a899090](https://discuss.elastic.co/u/a899090)\ **Replies:** 0\ **Last updated:** [January 29, 2019, 11:35am UTC](https://discuss.elastic.co/t/0365-unified-audit-csv-log/166155 "2019-01-29T11:35:44Z")
Hi Is there an already method of processing office365 unified log files to kibana? I have specific files (csv output) which i would like to process. --- ## [Connection between logstash and filebeat](https://discuss.elastic.co/t/connection-between-logstash-and-filebeat/166119)
**Author:** [@cppatel](https://discuss.elastic.co/u/cppatel)\ **Replies:** 5\ **Last updated:** [January 29, 2019, 10:16am UTC](https://discuss.elastic.co/t/connection-between-logstash-and-filebeat/166119 "2019-01-29T10:16:53Z")
Architecture setup: logstash : logstash-6.4.0-1.noarch (installed on RHEL7.5) filebeat : filebeat version 6.4.0 (installed on Windows 2016 (64 bit OS)) elasticsearch : elasticsearch-oss-6.4.0-1.noarch (installed on R… --- ## [How to stream log data from the Kinesis stream to Elasticsearch?](https://discuss.elastic.co/t/how-to-stream-log-data-from-the-kinesis-stream-to-elasticsearch/166134)
**Author:** [@dmakeroam](https://discuss.elastic.co/u/dmakeroam)\ **Replies:** 0\ **Last updated:** [January 29, 2019, 10:04am UTC](https://discuss.elastic.co/t/how-to-stream-log-data-from-the-kinesis-stream-to-elasticsearch/166134 "2019-01-29T10:04:33Z")
How to stream log data from the Kinesis stream to Elasticsearch? I have used logstash kinesis input plugin, but it doesn't seems to works. This is my logstash configuration for the Kinesis stream. input { kinesis { … --- ## [Uploading the same file to elastic via logstash is way slower than uploading it via the Kibana UI](https://discuss.elastic.co/t/uploading-the-same-file-to-elastic-via-logstash-is-way-slower-than-uploading-it-via-the-kibana-ui/166061)
**Author:** [@dhmtasos](https://discuss.elastic.co/u/dhmtasos)\ **Replies:** 4\ **Last updated:** [January 29, 2019, 9:52am UTC](https://discuss.elastic.co/t/uploading-the-same-file-to-elastic-via-logstash-is-way-slower-than-uploading-it-via-the-kibana-ui/166061 "2019-01-29T09:52:43Z")
I have a 10MB file in size with 500000 lines. Each line has this text: text\_entry,$i where $i = line number My logstash.conf file looks like this: input { file { path =\> "C:/Users/anasdima/Workspace/data-tests/10MB-… --- ## [Looking for idea to preprocess logs](https://discuss.elastic.co/t/looking-for-idea-to-preprocess-logs/166113)
**Author:** [@imaad](https://discuss.elastic.co/u/imaad)\ **Replies:** 4\ **Last updated:** [January 29, 2019, 9:51am UTC](https://discuss.elastic.co/t/looking-for-idea-to-preprocess-logs/166113 "2019-01-29T09:51:22Z")
Hello guys, In my log file, multiple threads are logged in the same file and this causes a badly ordered file which looks like : 2018-12-13T11:46:13.654+0000 Regulatory \[INFO\] Transaction etc... 2018-12-13T13:13:22.449… --- ## [Logstash parsing alphanumeric value](https://discuss.elastic.co/t/logstash-parsing-alphanumeric-value/166121)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 0\ **Last updated:** [January 29, 2019, 9:36am UTC](https://discuss.elastic.co/t/logstash-parsing-alphanumeric-value/166121 "2019-01-29T09:36:57Z")
When i parse the logstash value which contains password field it contains alpha numeric values.During indexing since the cardinality of the field is high whether will it consume too much of disk space? --- ## [Parsing logs from file](https://discuss.elastic.co/t/parsing-logs-from-file/163488)
**Author:** [@mrVladii](https://discuss.elastic.co/u/mrVladii)\ **Replies:** 2\ **Last updated:** [January 29, 2019, 6:24am UTC](https://discuss.elastic.co/t/parsing-logs-from-file/163488 "2019-01-29T06:24:39Z")
Hello, i tried to parse logs from file and send data to elasticsearch. And for some reason, I do not parse file. I use the following "logstash.conf" file: input { file{ path=\>"D:\\Project\\logs.log" start\_position =\>… --- ## [How to split message field for IIS log.. In debugger it is splitting but when i run config file it is not splitting, so not able to use in Kibana Grpahs](https://discuss.elastic.co/t/how-to-split-message-field-for-iis-log-in-debugger-it-is-splitting-but-when-i-run-config-file-it-is-not-splitting-so-not-able-to-use-in-kibana-grpahs/164914)
**Author:** [@Rahul07](https://discuss.elastic.co/u/Rahul07)\ **Replies:** 1\ **Last updated:** [January 29, 2019, 6:16am UTC](https://discuss.elastic.co/t/how-to-split-message-field-for-iis-log-in-debugger-it-is-splitting-but-when-i-run-config-file-it-is-not-splitting-so-not-able-to-use-in-kibana-grpahs/164914 "2019-01-29T06:16:47Z")
Sample logs \< #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes c… --- ## [Compare field value with field from csv , database and set a new field](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001)
**Author:** [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Replies:** 4\ **Last updated:** [January 29, 2019, 6:09am UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001 "2019-01-29T06:09:43Z")
My events are having fields like timestamp, version , sitename , url and score Whenever the data parsed to logstash , I want to compare the score field of the url fields between different version field. As i have searc… --- ## [Enable https from logstash to elasticsearch](https://discuss.elastic.co/t/enable-https-from-logstash-to-elasticsearch/166074)
**Author:** [@BoffinPanda](https://discuss.elastic.co/u/BoffinPanda)\ **Replies:** 0\ **Last updated:** [January 29, 2019, 3:40am UTC](https://discuss.elastic.co/t/enable-https-from-logstash-to-elasticsearch/166074 "2019-01-29T03:40:15Z")
I have enabled https in elasticsearch by following this guide Now, my elasticsearch is on https. The same does not work on logstash. I have a conf file which would receive traffic at http port 9600 in logstash and lo… --- ## [Cleaner if statements](https://discuss.elastic.co/t/cleaner-if-statements/163796)
**Author:** [@fozboz](https://discuss.elastic.co/u/fozboz)\ **Replies:** 2\ **Last updated:** [January 28, 2019, 11:34pm UTC](https://discuss.elastic.co/t/cleaner-if-statements/163796 "2019-01-28T23:34:44Z")
Is there a tidier way to write this? if \[content\]\[eventType\] == 11 or \[content\]\[eventType\] == 13 or \[content\]\[eventType\] == 20 or \[content\]\[eventType\] == 21 or \[content\]\[eventType\] == 23 or \[content\]\[eventType\] == 26 { … --- ## [Elasticsearch has moved to new location. How to configure logstash to take it's place and forward to new location](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913)
**Author:** [@sejnub](https://discuss.elastic.co/u/sejnub)\ **Replies:** 5\ **Last updated:** [January 28, 2019, 10:55pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913 "2019-01-28T22:55:54Z")
Multiple clients send there documents to the old elasticsearch location (IP). Instead of changing the config of all these clients I want to put a logstash instance at the old ES location and let it forward all the traffi… --- ## [Geoip filter reports incorrect location](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667)
**Author:** [@andrew](https://discuss.elastic.co/u/andrew)\ **Replies:** 3\ **Last updated:** [January 28, 2019, 8:20pm UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667 "2019-01-28T20:20:35Z")
I discovered some incorrect results when geocoding IP addresses through the geoip filter in Logsstash 6.5.4. The IP address in question is 185.234.217.248. If I go to https://www.maxmind.com/en/geoip-demo it gives me: … --- ## [Dissect and kv filter](https://discuss.elastic.co/t/dissect-and-kv-filter/165250)
**Author:** [@Necus](https://discuss.elastic.co/u/Necus)\ **Replies:** 6\ **Last updated:** [January 28, 2019, 8:19pm UTC](https://discuss.elastic.co/t/dissect-and-kv-filter/165250 "2019-01-28T20:19:35Z")
Hi, I'm using dissect filter to quickly parse data. Then i would like to use kv to divide one of the newly created field into many values. new field: field1=value1,field2=value2,field3=\[abc, abc2, abc3\],field4=value4 … --- ## [How do I check if Logstash is receiving logs from filebeat?](https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652)
**Author:** [@CG3](https://discuss.elastic.co/u/CG3)\ **Replies:** 2\ **Last updated:** [January 28, 2019, 8:11pm UTC](https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652 "2019-01-28T20:11:47Z")
I have an elastic cluster using logstash as the receiver of data. I have several windows machines collecting logs with filebeat and sending to logstash to view in kibana. This is working fine. I now need to add a Linu… --- ## [Template mapping examples not clear for geoip](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832)
**Author:** [@CharlieBrown](https://discuss.elastic.co/u/CharlieBrown)\ **Replies:** 5\ **Last updated:** [January 28, 2019, 5:55pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832 "2019-01-28T17:55:21Z")
I have tried searching the web for answers but lately it seems that most search engines return completely unrelated results. Therefore I registered so I can ask real people for some help. The instructions here: https://… --- ## [Cannot get Logstash to read in a file on Windows](https://discuss.elastic.co/t/cannot-get-logstash-to-read-in-a-file-on-windows/164728)
**Author:** [@MindfulMantis](https://discuss.elastic.co/u/MindfulMantis)\ **Replies:** 3\ **Last updated:** [January 28, 2019, 5:39pm UTC](https://discuss.elastic.co/t/cannot-get-logstash-to-read-in-a-file-on-windows/164728 "2019-01-28T17:39:14Z")
My colleague and I have both installed ELK using Bitnami and are both having issues getting Logstash to be able to successfully read an input file - we're hoping someone here may be able to spot an issue with our setup. … --- ## [Replace double backslashes // with one / in a string](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858)
**Author:** [@x4cker](https://discuss.elastic.co/u/x4cker)\ **Replies:** 6\ **Last updated:** [January 28, 2019, 4:38pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858 "2019-01-28T16:38:57Z")
Hi, how can I replace the double backslashes with only one? input: domain\\\\user expected output: domain\\user i have tried several methods without success. I could only remove it in this way, but it's not what's neede… --- ## [Logstash mutating/renaming with glob](https://discuss.elastic.co/t/logstash-mutating-renaming-with-glob/165865)
**Author:** [@tszyro](https://discuss.elastic.co/u/tszyro)\ **Replies:** 5\ **Last updated:** [January 28, 2019, 4:04pm UTC](https://discuss.elastic.co/t/logstash-mutating-renaming-with-glob/165865 "2019-01-28T16:04:17Z")
I try to efficiently rename pattern in logstash. So if the json field comes as instrument\_network\_a it will be renamed to network.labels.a, it it comes as instrument\_network\_b it will be renamed to network.labels.b and s… --- ## [Logstash sending all data to elasticsearch via wrong pipeline](https://discuss.elastic.co/t/logstash-sending-all-data-to-elasticsearch-via-wrong-pipeline/165799)
**Author:** [@Wellguys](https://discuss.elastic.co/u/Wellguys)\ **Replies:** 10\ **Last updated:** [January 28, 2019, 3:59pm UTC](https://discuss.elastic.co/t/logstash-sending-all-data-to-elasticsearch-via-wrong-pipeline/165799 "2019-01-28T15:59:52Z")
Hello everyone. I'm having an issue with pipelines, I think I caused the problem but can't find where it is. I have two servers, one running ELK and Filebeat, the other running Apache and Filebeat. What I am trying to … --- ## [JMX input plugin overload](https://discuss.elastic.co/t/jmx-input-plugin-overload/166011)
**Author:** [@Martijn](https://discuss.elastic.co/u/Martijn)\ **Replies:** 0\ **Last updated:** [January 28, 2019, 2:50pm UTC](https://discuss.elastic.co/t/jmx-input-plugin-overload/166011 "2019-01-28T14:50:05Z")
Hi all, I am using the JMX input plugin for Logstash to collect JVM statistics for a set of webservices. There are about 150 in total, spread over 2 servers. The polling is done every 60 seconds. I noticed that this po… --- ## [Access dynamic field](https://discuss.elastic.co/t/access-dynamic-field/165997)
**Author:** [@imaad](https://discuss.elastic.co/u/imaad)\ **Replies:** 2\ **Last updated:** [January 28, 2019, 2:39pm UTC](https://discuss.elastic.co/t/access-dynamic-field/165997 "2019-01-28T14:39:05Z")
Hello, In my event, I have a field "end\_date\_null\_count" =\> 7 and then I use the mutate plugin to add another field "last\_null\_value" =\> "column7" : mutate { add\_field =\> {"last\_null\_value" =\> "colum… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=609) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=611)