# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=613 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 614 --- ## [Matching multiline log message with Grok](https://discuss.elastic.co/t/matching-multiline-log-message-with-grok/165474)
**Author:** [@yungnvn](https://discuss.elastic.co/u/yungnvn)\ **Replies:** 3\ **Last updated:** [January 23, 2019, 10:42pm UTC](https://discuss.elastic.co/t/matching-multiline-log-message-with-grok/165474 "2019-01-23T22:42:44Z")
I have these three lines of log messages: 2019-01-10 15:41:22,164 INFO \[ajp-nio-8010-exec-21\] wt.system.out manlla - specIdOR:com.lcs.wc.specification.FlexSpecToSeasonLink:1071796633 2019-01-10 15:41:24,160 DEBUG \[ajp-… --- ## [Any best practices for upgrading my ELK stack?](https://discuss.elastic.co/t/any-best-practices-for-upgrading-my-elk-stack/165277)
**Author:** [@drivera](https://discuss.elastic.co/u/drivera)\ **Replies:** 2\ **Last updated:** [January 23, 2019, 10:07pm UTC](https://discuss.elastic.co/t/any-best-practices-for-upgrading-my-elk-stack/165277 "2019-01-23T22:07:59Z")
All, I'm currently running the versions below and would like to upgrade to the latest versions. However, my understanding is that it would be better to upgrade to 5.6 first and then to 6.x. Is that correct, can someone o… --- ## [Exception=\>"NoMethodError", :message=\>"undefined method \`unlock' for nil:NilClass"](https://discuss.elastic.co/t/exception-nomethoderror-message-undefined-method-unlock-for-nil-nilclass/165470)
**Author:** [@Marcos\_OS](https://discuss.elastic.co/u/Marcos_OS)\ **Replies:** 8\ **Last updated:** [January 23, 2019, 8:53pm UTC](https://discuss.elastic.co/t/exception-nomethoderror-message-undefined-method-unlock-for-nil-nilclass/165470 "2019-01-23T20:53:55Z")
Could someone help me with the following situation: When I have the filter below, I have the expected result filter { ruby { code =\> ' fieldname = event.get("type") + "datref" event.set("datref", event.get(fie… --- ## [Grok filter for IIS no working](https://discuss.elastic.co/t/grok-filter-for-iis-no-working/164157)
**Author:** [@Carlos\_Bodini](https://discuss.elastic.co/u/Carlos_Bodini)\ **Replies:** 17\ **Last updated:** [January 23, 2019, 7:23pm UTC](https://discuss.elastic.co/t/grok-filter-for-iis-no-working/164157 "2019-01-23T19:23:35Z")
hey there, my grok filter for IIS logs is not working on logstash, however it worok on kibana debugger: input { beats { port =\> 5044 type =\> "log" port=\> 5044 type =\> "iis" } filter { if \[type\] == "iis" { grok… --- ## [Index not created after template update](https://discuss.elastic.co/t/index-not-created-after-template-update/165076)
**Author:** [@wholzgruber](https://discuss.elastic.co/u/wholzgruber)\ **Replies:** 11\ **Last updated:** [January 23, 2019, 6:23pm UTC](https://discuss.elastic.co/t/index-not-created-after-template-update/165076 "2019-01-23T18:23:56Z")
Dear Community, I need your help again. Following situation: I´ve downloaded the default logstash template with: curl -XGET '192.168.100.92:9200/\_template/logstash?pretty' \> logstash-template.json updated the default… --- ## [Replace @timestamp with source log timestamp](https://discuss.elastic.co/t/replace-timestamp-with-source-log-timestamp/162346)
**Author:** [@wholzgruber](https://discuss.elastic.co/u/wholzgruber)\ **Replies:** 26\ **Last updated:** [January 23, 2019, 6:23pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-source-log-timestamp/162346 "2019-01-23T18:23:07Z")
Dear Community, I´m quite new in ELK and also here in the community. So at first hi everybody! I´ve spent a couple of hours by solving this issue. A lot of ther topics here in the community had simmilar issues. But th… --- ## [Pointing logstash to different Java](https://discuss.elastic.co/t/pointing-logstash-to-different-java/165468)
**Author:** [@tszyro](https://discuss.elastic.co/u/tszyro)\ **Replies:** 0\ **Last updated:** [January 23, 2019, 6:15pm UTC](https://discuss.elastic.co/t/pointing-logstash-to-different-java/165468 "2019-01-23T18:15:59Z")
I am trying to run logstash 6.5 on linux where I don't have roots right. By default there is Java 1.6 but I have jdk with Java 1.8 which I can run application from I have changed the startup.options following discussi… --- ## [exception=\>"Java::JavaNet::URISyntaxException", :message=\>"Illegal character in path at index 0: \[\\"esi1\\",\\"esi2\\"\]"](https://discuss.elastic.co/t/exception-java-urisyntaxexception-message-illegal-character-in-path-at-index-0-esi1-esi2/165456)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 4\ **Last updated:** [January 23, 2019, 5:57pm UTC](https://discuss.elastic.co/t/exception-java-urisyntaxexception-message-illegal-character-in-path-at-index-0-esi1-esi2/165456 "2019-01-23T17:57:43Z")
Hello, I'm running Logstash with Environment variable configuration. I'm also trying to follow Using Environment Variables in the Configuration to define Elasticsearch output plugin. my environment variable: # grep HO… --- ## [How to convert date fields coming from MongoDB to an Elasticsearch date field?](https://discuss.elastic.co/t/how-to-convert-date-fields-coming-from-mongodb-to-an-elasticsearch-date-field/165429)
**Author:** [@topgun743](https://discuss.elastic.co/u/topgun743)\ **Replies:** 1\ **Last updated:** [January 23, 2019, 4:49pm UTC](https://discuss.elastic.co/t/how-to-convert-date-fields-coming-from-mongodb-to-an-elasticsearch-date-field/165429 "2019-01-23T16:49:17Z")
I am using logstash-file-mongodb plugin for indexing data to Elasticsearch coming from MongoDB. Here in my input file: input { mongodb { uri =\> 'mongodb://myuser:mypwd@myhost/TestDB' placeholder\_db\_dir =\> 'E:/logs… --- ## [Logstash not filtering IIS message into fields in Kibana](https://discuss.elastic.co/t/logstash-not-filtering-iis-message-into-fields-in-kibana/165157)
**Author:** [@Shafiq](https://discuss.elastic.co/u/Shafiq)\ **Replies:** 3\ **Last updated:** [January 23, 2019, 2:36pm UTC](https://discuss.elastic.co/t/logstash-not-filtering-iis-message-into-fields-in-kibana/165157 "2019-01-23T14:36:22Z")
Hi There, I have setup Elasticsearch, Logstash, Kibana and filebeat 6.5.4 version on Windows server 2012 R2. I have configured Filebeat to collect the logs of IIS and send to logstash. In kibana I can see the IIS logs … --- ## [Logstash crashes when converting fields to ECS Format](https://discuss.elastic.co/t/logstash-crashes-when-converting-fields-to-ecs-format/165306)
**Author:** [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\ **Replies:** 3\ **Last updated:** [January 23, 2019, 2:30pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-converting-fields-to-ecs-format/165306 "2019-01-23T14:30:03Z")
Got some logstash errors while converting fields to the Elastic Common Schema (ECS). Logstash version: logstash 6.0.0 The goal is to rename a source field into an ecs compliant field e.g \[destination\]\[field\] echo '{"s… --- ## [Error registering plugin with jdbc\_static plugin](https://discuss.elastic.co/t/error-registering-plugin-with-jdbc-static-plugin/164536)
**Author:** [@roblopes](https://discuss.elastic.co/u/roblopes)\ **Replies:** 7\ **Last updated:** [January 23, 2019, 1:51pm UTC](https://discuss.elastic.co/t/error-registering-plugin-with-jdbc-static-plugin/164536 "2019-01-23T13:51:40Z")
Hi, This is a logstash (6.5.1) process that runs fine for months now, but in order to optimize its performance, I am trying to add the jdbc\_static plugin, so I don't have to lookup in logstash a "domain table", since it… --- ## [Date filter treat the timestamp of the same log differently](https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403)
**Author:** [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\ **Replies:** 2\ **Last updated:** [January 23, 2019, 1:39pm UTC](https://discuss.elastic.co/t/date-filter-treat-the-timestamp-of-the-same-log-differently/165403 "2019-01-23T13:39:04Z")
Hello I hava a problem about date filter. My conf is below. input { file { path =\> "/var/log/secure" } } filter { dissect { mapping =\> { "message" =\> "%{timestamp-\>} %{+timestamp} %{+timestamp} %{hostname} %{anothe… --- ## [Parsing JSON in Logstash - Getting \_jsonparsefailure error](https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386)
**Author:** [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\ **Replies:** 2\ **Last updated:** [January 23, 2019, 1:31pm UTC](https://discuss.elastic.co/t/parsing-json-in-logstash-getting-jsonparsefailure-error/165386 "2019-01-23T13:31:17Z")
Hi I am trying to parse a JSON file as below: { "glossary": { "title": "example glossary", "GlossDiv": { "title": "S", "GlossList": { "GlossEntry": { "I… --- ## [Logstah to parse only if matches the log](https://discuss.elastic.co/t/logstah-to-parse-only-if-matches-the-log/165258)
**Author:** [@yazhini](https://discuss.elastic.co/u/yazhini)\ **Replies:** 3\ **Last updated:** [January 23, 2019, 1:04pm UTC](https://discuss.elastic.co/t/logstah-to-parse-only-if-matches-the-log/165258 "2019-01-23T13:04:05Z")
I have around 30+ error strings for docker logs. I need logstash to parse the logs only if it matches those error strings. --- ## [JDBC Input plugin, Communication link failure in Logstash version 6.5.4 (latest)](https://discuss.elastic.co/t/jdbc-input-plugin-communication-link-failure-in-logstash-version-6-5-4-latest/164983)
**Author:** [@Abhishek\_Wahi](https://discuss.elastic.co/u/Abhishek_Wahi)\ **Replies:** 7\ **Last updated:** [January 23, 2019, 10:28am UTC](https://discuss.elastic.co/t/jdbc-input-plugin-communication-link-failure-in-logstash-version-6-5-4-latest/164983 "2019-01-23T10:28:13Z")
Hi, I am facing this issue with JDBC input plugin. Sometime my logstash script throw this error : \[2019-01-21T00:59:25,984\]\[ERROR\]\[logstash.inputs.jdbc \] Unable to connect to database. Tried 1 times {:error\_messag… --- ## [Parsing jbpm multiline logs](https://discuss.elastic.co/t/parsing-jbpm-multiline-logs/165074)
**Author:** [@Abdelrahman\_Fahmy](https://discuss.elastic.co/u/Abdelrahman_Fahmy)\ **Replies:** 2\ **Last updated:** [January 23, 2019, 9:53am UTC](https://discuss.elastic.co/t/parsing-jbpm-multiline-logs/165074 "2019-01-23T09:53:49Z")
hi I am trying to ship my jbpm logs to elasticsearch using logstash. but i am new and i dont know how to create the correct logstash config file here is a sample of the logs 2019-01-14 05:26:27,979 FINE \[com.infosys… --- ## [If elseif else expression in conf - how to use many of them](https://discuss.elastic.co/t/if-elseif-else-expression-in-conf-how-to-use-many-of-them/165357)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 2\ **Last updated:** [January 23, 2019, 9:22am UTC](https://discuss.elastic.co/t/if-elseif-else-expression-in-conf-how-to-use-many-of-them/165357 "2019-01-23T09:22:38Z")
Hi all, question: I want to use many if blocks: is this statement ok or do I need always "else" to end the "if" expression? if "Resource" in \[Error\_Code\]{ mutate {add\_tag =\> "Recource"} } else if "State" in \[Err… --- ## [Date Filter not working with IST](https://discuss.elastic.co/t/date-filter-not-working-with-ist/165219)
**Author:** [@Harsh\_Sharma](https://discuss.elastic.co/u/Harsh_Sharma)\ **Replies:** 6\ **Last updated:** [January 23, 2019, 9:14am UTC](https://discuss.elastic.co/t/date-filter-not-working-with-ist/165219 "2019-01-23T09:14:00Z")
Hi, I'm using logstash 6.5.4. Below is my sample log & input file - Sample log - 2019-01-12 13:10:38 IST,9898989898,HHH-444 2019-01-12 13:11:38 IST,9898989897,HHH-555 filter{ if "test111" in \[log\_type\] { … --- ## [How to pipeline.yml - I'm stuck](https://discuss.elastic.co/t/how-to-pipeline-yml-im-stuck/165254)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 4\ **Last updated:** [January 23, 2019, 8:26am UTC](https://discuss.elastic.co/t/how-to-pipeline-yml-im-stuck/165254 "2019-01-23T08:26:06Z")
Hi There, due to the original documentation does not help, I hope you could! I have a logstash conf file. That works fine as Standalone. Now I have 3 files which I want to index These 3 files are different, so each… --- ## [Logstash error:no implicit conversion of fixnum into string](https://discuss.elastic.co/t/logstash-error-no-implicit-conversion-of-fixnum-into-string/165014)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 5\ **Last updated:** [January 22, 2019, 1:44pm UTC](https://discuss.elastic.co/t/logstash-error-no-implicit-conversion-of-fixnum-into-string/165014 "2019-01-22T13:44:22Z")
hi all I am using file beat, logstash , elasticsearch and kibana. my filebeat ships logs into logstash, but following error can be found in logstash log: \[2019-01-21T12:30:54,588\]\[ERROR\]\[logstash.pipeline \] Er… --- ## [Logstash-input-zeromq won't install on logstash 6.5.4](https://discuss.elastic.co/t/logstash-input-zeromq-wont-install-on-logstash-6-5-4/165334)
**Author:** [@cmessin1](https://discuss.elastic.co/u/cmessin1)\ **Replies:** 0\ **Last updated:** [January 23, 2019, 5:21am UTC](https://discuss.elastic.co/t/logstash-input-zeromq-wont-install-on-logstash-6-5-4/165334 "2019-01-23T05:21:40Z")
I am getting multiple dependency errors when trying to install logstash-input-zeromq on logstash 6.5.4. Full output is probably too long to post but here is the beginning of it. I did try to do some manual installs wit… --- ## [Logstash code=\>"json" not parse complex json log as expected (please close this topic)](https://discuss.elastic.co/t/logstash-code-json-not-parse-complex-json-log-as-expected-please-close-this-topic/164940)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 3\ **Last updated:** [January 21, 2019, 2:10am UTC](https://discuss.elastic.co/t/logstash-code-json-not-parse-complex-json-log-as-expected-please-close-this-topic/164940 "2019-01-21T02:10:12Z")
Hi team, I have below logstash.conf and json event. Most of the fields are parsed correctly, but for complex array types, it looks like that not parsed as expecte. For example, profile criteria and rating criteria are j… --- ## [Adding a new field from each field of row from table imported from .csv file](https://discuss.elastic.co/t/adding-a-new-field-from-each-field-of-row-from-table-imported-from-csv-file/165070)
**Author:** [@bard0x](https://discuss.elastic.co/u/bard0x)\ **Replies:** 1\ **Last updated:** [January 22, 2019, 10:22pm UTC](https://discuss.elastic.co/t/adding-a-new-field-from-each-field-of-row-from-table-imported-from-csv-file/165070 "2019-01-22T22:22:36Z")
Hello everyone, I imported an .csv file with filebeat and in logstash config file I created this filter: filter { csv { separator =\> "," columns =\> \["ID","Name","Age","Photo","Nationality","Flag","Overall… --- ## [Installing custom plugin failing with "undefined method \`source\_uri' for nil:NilClass"](https://discuss.elastic.co/t/installing-custom-plugin-failing-with-undefined-method-source-uri-for-nil-nilclass/165298)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 8:59pm UTC](https://discuss.elastic.co/t/installing-custom-plugin-failing-with-undefined-method-source-uri-for-nil-nilclass/165298 "2019-01-22T20:59:44Z")
I'm trying to install a custom Logstash output plugin in my Logstash 6.5 environment but am get this error: undefined method \`source\_uri' for nil:NilClass In doing research on this particular error I ran across a bug r… --- ## [Logstash GeoIp in Packetbeat pattern](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100)
**Author:** [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)\ **Replies:** 12\ **Last updated:** [January 22, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100 "2019-01-22T18:41:35Z")
hi, currently i'm trying to show GeoIp points using LogStash with Packetbeat and the best solution that I find is using this logstash-packtebeat.conf file: input { beats { type =\> beats port =\> 5044 … --- ## [Date filter for CreatedDate](https://discuss.elastic.co/t/date-filter-for-createddate/165131)
**Author:** [@chandra0651](https://discuss.elastic.co/u/chandra0651)\ **Replies:** 3\ **Last updated:** [January 22, 2019, 5:42pm UTC](https://discuss.elastic.co/t/date-filter-for-createddate/165131 "2019-01-22T17:42:51Z")
Hello I am trying to assign the CreatedDate as @timestamp for the records which are processed through logstash, Source of my input is Salesforce. date { match =\> \["CreatedDate", "yyyy-MM-dd'T'HH:mm:ss.SSSZ", "ISO8601"… --- ## [Logstash Redis Output Plugin](https://discuss.elastic.co/t/logstash-redis-output-plugin/165208)
**Author:** [@zentolo](https://discuss.elastic.co/u/zentolo)\ **Replies:** 1\ **Last updated:** [January 22, 2019, 5:39pm UTC](https://discuss.elastic.co/t/logstash-redis-output-plugin/165208 "2019-01-22T17:39:43Z")
I have a question about Output redis plugin Array format. I have configured 3 redis servers on array on the logstash redis output (shipper). I have configured on redis server 1.000.000 limit. When one of the redis ser… --- ## [How to aggregate metrics from netdata in logstash?](https://discuss.elastic.co/t/how-to-aggregate-metrics-from-netdata-in-logstash/165265)
**Author:** [@EnzoAkira](https://discuss.elastic.co/u/EnzoAkira)\ **Replies:** 2\ **Last updated:** [January 22, 2019, 5:26pm UTC](https://discuss.elastic.co/t/how-to-aggregate-metrics-from-netdata-in-logstash/165265 "2019-01-22T17:26:46Z")
Thank you in advance for any help! I'm using Netdata to collect metrics from servers and then send them to Logstash and to Elastic. My need is to aggregate metrics with same fields and create a single event but in nest… --- ## [Multiple split filters are used in the logstash for processing xml file of size 8MB is taking more than 30 minutes](https://discuss.elastic.co/t/multiple-split-filters-are-used-in-the-logstash-for-processing-xml-file-of-size-8mb-is-taking-more-than-30-minutes/165088)
**Author:** [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Replies:** 4\ **Last updated:** [January 22, 2019, 4:21pm UTC](https://discuss.elastic.co/t/multiple-split-filters-are-used-in-the-logstash-for-processing-xml-file-of-size-8mb-is-taking-more-than-30-minutes/165088 "2019-01-22T16:21:51Z")
JVM size : 4GB, 4 core CPU The xml file size is 8MB and in the beat.conf of logstash we used 4-5 split, xml filters. It is taking more than 30 minutes. Please can u help on this or suggest a way whether any configurat… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=612) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=614)