# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=620 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 621 --- ## [Error: Could not find or load main class Files\\Microsoft](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class-files-microsoft/163841)
**Author:** [@titus](https://discuss.elastic.co/u/titus)\ **Replies:** 0\ **Last updated:** [January 11, 2019, 5:44am UTC](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class-files-microsoft/163841 "2019-01-11T05:44:22Z")
I am writing this down because maybe there are some of you that waste days to fix this. it drove me nuts. PROBLEM: Unzip logstash (any version) to Windows 10 - English us Locale. Unziped using "win zip" and "win rar". … --- ## [Ruby script initialize variable only once](https://discuss.elastic.co/t/ruby-script-initialize-variable-only-once/163672)
**Author:** [@pohsun.teh](https://discuss.elastic.co/u/pohsun.teh)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 7:53am UTC](https://discuss.elastic.co/t/ruby-script-initialize-variable-only-once/163672 "2019-01-10T07:53:02Z")
Sorry, not sure if my problem falls under Logstash or plain Ruby. Using ruby script, how do I initialize my variable only once? I get that the script would be executed for every events, is it possible to have something … --- ## [Logstash （It seems your ruby installation is missing psych (for YAML output).）](https://discuss.elastic.co/t/logstash-it-seems-your-ruby-installation-is-missing-psych-for-yaml-output/163834)
**Author:** [@Buxunxian](https://discuss.elastic.co/u/Buxunxian)\ **Replies:** 0\ **Last updated:** [January 11, 2019, 2:37am UTC](https://discuss.elastic.co/t/logstash-it-seems-your-ruby-installation-is-missing-psych-for-yaml-output/163834 "2019-01-11T02:37:54Z")
log: Jan 11 10:26:45 fnw-test-logstash-3 systemd\[1\]: logstash.service: main process exited, code=exited, status=143/n/a Jan 11 10:26:45 fnw-test-logstash-3 systemd\[1\]: Stopped logstash. Jan 11 10:26:45 fnw-test-logstash… --- ## [Will there eventually be alpine-based docker images for Logstash 6.x?](https://discuss.elastic.co/t/will-there-eventually-be-alpine-based-docker-images-for-logstash-6-x/163623)
**Author:** [@Jim\_Hurne](https://discuss.elastic.co/u/Jim_Hurne)\ **Replies:** 4\ **Last updated:** [January 11, 2019, 1:27am UTC](https://discuss.elastic.co/t/will-there-eventually-be-alpine-based-docker-images-for-logstash-6-x/163623 "2019-01-11T01:27:26Z")
I was looking at the available Logstash docker images and it looks like there are alpine-based versions available for the 5.x version tree, but not for the 6.x version tree. Are there plans to make Alpine versions availa… --- ## [Logstash API successfully started but the data doesnot load](https://discuss.elastic.co/t/logstash-api-successfully-started-but-the-data-doesnot-load/163806)
**Author:** [@sahil\_ahmed](https://discuss.elastic.co/u/sahil_ahmed)\ **Replies:** 3\ **Last updated:** [January 10, 2019, 9:42pm UTC](https://discuss.elastic.co/t/logstash-api-successfully-started-but-the-data-doesnot-load/163806 "2019-01-10T21:42:29Z")
Hello, I was trying to input a csv file, It says pipeline started successfully, pipelines running, successfully started started logstash API endpoint {:port=\>9600} but it is not loading the csv file. any suggestions? Th… --- ## [Multiple pipelines with Kafka input](https://discuss.elastic.co/t/multiple-pipelines-with-kafka-input/163641)
**Author:** [@rocknroll](https://discuss.elastic.co/u/rocknroll)\ **Replies:** 4\ **Last updated:** [January 10, 2019, 8:50pm UTC](https://discuss.elastic.co/t/multiple-pipelines-with-kafka-input/163641 "2019-01-10T20:50:22Z")
When using the Kafka input plugin is it possible to assign different topics to their own pipeline in Logstash? e.g with the Beats input we can setup different input configs to get Logstash to listen on different ports. … --- ## [Grok filter for a custom message](https://discuss.elastic.co/t/grok-filter-for-a-custom-message/163527)
**Author:** [@mrashid](https://discuss.elastic.co/u/mrashid)\ **Replies:** 5\ **Last updated:** [January 10, 2019, 7:41pm UTC](https://discuss.elastic.co/t/grok-filter-for-a-custom-message/163527 "2019-01-10T19:41:32Z")
\*\* The build ID of the run is : 104 \*\* I have the above line in the message field . I am trying to use Grok filter to extract the entire line to a new field by the name of "filteredValue". WHat I have tried : filt… --- ## [Firewall configuration for Azure Event Hubs plugin](https://discuss.elastic.co/t/firewall-configuration-for-azure-event-hubs-plugin/163789)
**Author:** [@fim](https://discuss.elastic.co/u/fim)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 5:12pm UTC](https://discuss.elastic.co/t/firewall-configuration-for-azure-event-hubs-plugin/163789 "2019-01-10T17:12:04Z")
We tried to retrieve data from an Azure EventHub. Locally it works perfect but in our test environment it didn't. We suppose that a firewall is blocking the traffic since we get a timeout without error message. Can anyb… --- ## [How to handle logstash logs in ubuntu 18.04](https://discuss.elastic.co/t/how-to-handle-logstash-logs-in-ubuntu-18-04/162828)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 5\ **Last updated:** [January 10, 2019, 4:40pm UTC](https://discuss.elastic.co/t/how-to-handle-logstash-logs-in-ubuntu-18-04/162828 "2019-01-10T16:40:36Z")
i have couple of problem. The logstash document says logs saved in /var/log/logstash folder, but in my case log is saved in /usr/share/logstash/log folder ? so why is that ? Other problem i am having is ubuntu syslog… --- ## [Logstash not being monitored after I installed new licenses on ES nodes](https://discuss.elastic.co/t/logstash-not-being-monitored-after-i-installed-new-licenses-on-es-nodes/163624)
**Author:** [@Data77](https://discuss.elastic.co/u/Data77)\ **Replies:** 2\ **Last updated:** [January 10, 2019, 4:13pm UTC](https://discuss.elastic.co/t/logstash-not-being-monitored-after-i-installed-new-licenses-on-es-nodes/163624 "2019-01-10T16:13:52Z")
Hello I am using 5.6.12 Logstash, ES, and kibana (cannot use newer stuff wish I could) Essentially I had everything working fine with my configs until I had to update my license for ES. i used the command in docs to se… --- ## [JDBC sql server](https://discuss.elastic.co/t/jdbc-sql-server/163773)
**Author:** [@Costi](https://discuss.elastic.co/u/Costi)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 3:43pm UTC](https://discuss.elastic.co/t/jdbc-sql-server/163773 "2019-01-10T15:43:37Z")
Hi! I am using jdbc to connect to sql server and to query a table to index the data in elasticsearch. When i run from logstash a get the following error: An unknown error occurred sending a bulk request to Elasticsearch… --- ## [JDBC Plugin - Missing Converter handling for full class name=org.postgresql.util.PGobject, simple name=PGobject](https://discuss.elastic.co/t/jdbc-plugin-missing-converter-handling-for-full-class-name-org-postgresql-util-pgobject-simple-name-pgobject/163772)
**Author:** [@jamesamuir](https://discuss.elastic.co/u/jamesamuir)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 3:43pm UTC](https://discuss.elastic.co/t/jdbc-plugin-missing-converter-handling-for-full-class-name-org-postgresql-util-pgobject-simple-name-pgobject/163772 "2019-01-10T15:43:34Z")
Hello, I am trying to determine how to get the JDBC plugin to correctly load JSON and JSONB field types from PostgreSQL. I am running Postgres 9.5 and Logstash 6.5. Here is an example to replicate. create table if not… --- ## [Multi dimension filter for logstash-input-cloudwatch plugin](https://discuss.elastic.co/t/multi-dimension-filter-for-logstash-input-cloudwatch-plugin/163647)
**Author:** [@Izek](https://discuss.elastic.co/u/Izek)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 2:59pm UTC](https://discuss.elastic.co/t/multi-dimension-filter-for-logstash-input-cloudwatch-plugin/163647 "2019-01-10T14:59:07Z")
I get a error message hen I using the logstash-input-cloudwatch to retrieve the metric with Multi dimension. Not sure the filters format is correct or not. config cloudwatch { namespace =\> "sqlserver" metric… --- ## [Logstash data updation is not working?](https://discuss.elastic.co/t/logstash-data-updation-is-not-working/163750)
**Author:** [@inandi](https://discuss.elastic.co/u/inandi)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 1:58pm UTC](https://discuss.elastic.co/t/logstash-data-updation-is-not-working/163750 "2019-01-10T13:58:02Z")
I have a logstash file running. it is working fine when inserting first time. but when I update the source file it is getting json\_parse\_error. the mapping and template is fine i think cause in first time its working fin… --- ## [Change default shards in Logstash](https://discuss.elastic.co/t/change-default-shards-in-logstash/163664)
**Author:** [@josephmanalo](https://discuss.elastic.co/u/josephmanalo)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 12:34pm UTC](https://discuss.elastic.co/t/change-default-shards-in-logstash/163664 "2019-01-10T12:34:26Z")
Hi. I have read the docs about index templates https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html But it is being done in CURL. How will I do this in Logstash? TYIA! --- ## [Tag failed (timedout) queries of dns filter plugin](https://discuss.elastic.co/t/tag-failed-timedout-queries-of-dns-filter-plugin/163727)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 11:44am UTC](https://discuss.elastic.co/t/tag-failed-timedout-queries-of-dns-filter-plugin/163727 "2019-01-10T11:44:25Z")
Is there a way to tag dns filter plugin events that received a dns (either reverse of forward) timeout with a specific tag? --- ## [How to prevent old log appending existing log in elasticsearch](https://discuss.elastic.co/t/how-to-prevent-old-log-appending-existing-log-in-elasticsearch/163656)
**Author:** [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)\ **Replies:** 7\ **Last updated:** [January 10, 2019, 11:24am UTC](https://discuss.elastic.co/t/how-to-prevent-old-log-appending-existing-log-in-elasticsearch/163656 "2019-01-10T11:24:31Z")
I am using filebeat to get logs from the remote server and shipping it to logstash so it's working fine. But when new logs being appending in the source log file so filebeat reads those logs from the beginning and send i… --- ## [Calculations in Logstash](https://discuss.elastic.co/t/calculations-in-logstash/163713)
**Author:** [@dfesenko](https://discuss.elastic.co/u/dfesenko)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 10:58am UTC](https://discuss.elastic.co/t/calculations-in-logstash/163713 "2019-01-10T10:58:15Z")
My server receives events, which then are processed by Logstash and saved into Elasticsearch as documents. I am completely new to ELK and I want to do the following. Based on the set of several fields in the received d… --- ## [Date interpreting problem double time line given in one message](https://discuss.elastic.co/t/date-interpreting-problem-double-time-line-given-in-one-message/163708)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 10:35am UTC](https://discuss.elastic.co/t/date-interpreting-problem-double-time-line-given-in-one-message/163708 "2019-01-10T10:35:43Z")
Hi Guys and Gals We have a messy logfile, that I'm working my way through. Most of it is now correct, but for some reason I have an issue if the logfile contains two entries on top of each other. Normally an entry loo… --- ## [Http\_poller – Run once and terminate](https://discuss.elastic.co/t/http-poller-run-once-and-terminate/163195)
**Author:** [@darefilz](https://discuss.elastic.co/u/darefilz)\ **Replies:** 6\ **Last updated:** [January 10, 2019, 8:04am UTC](https://discuss.elastic.co/t/http-poller-run-once-and-terminate/163195 "2019-01-10T08:04:27Z")
Hi, I want to use the Http\_poller input plugin to call a REST API only once. The actual scheduling is done outside of Logstash (Docker). To make this happen, I set the schedule attribute to { "in" =\> "0" }, which indee… --- ## [Achieve incremental query for Elasticsearch Input Plugin](https://discuss.elastic.co/t/achieve-incremental-query-for-elasticsearch-input-plugin/163668)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 0\ **Last updated:** [January 10, 2019, 7:23am UTC](https://discuss.elastic.co/t/achieve-incremental-query-for-elasticsearch-input-plugin/163668 "2019-01-10T07:23:25Z")
Hi, My use case is similar to this Question and this issue I am trying to query an index for which i need only the new values based on a timefield. Is it possible to have a similar functionality like sql\_last\_value i… --- ## [Permission denied on config](https://discuss.elastic.co/t/permission-denied-on-config/163489)
**Author:** [@Narzhan](https://discuss.elastic.co/u/Narzhan)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 5:06am UTC](https://discuss.elastic.co/t/permission-denied-on-config/163489 "2019-01-10T05:06:30Z")
I'm running Logstash 6.5.4 in Docker with my custom configuration. However the configuration cannot be read by Logstash. There are exceptions regarding file reading not enabled. I've tried setting permissions of differen… --- ## [Disable sincedb/Ingesting data from files with same name](https://discuss.elastic.co/t/disable-sincedb-ingesting-data-from-files-with-same-name/163632)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 11:30pm UTC](https://discuss.elastic.co/t/disable-sincedb-ingesting-data-from-files-with-same-name/163632 "2019-01-09T23:30:06Z")
I have a need to ingest logs from multiple computers where the filename is always the same. I seem to be running into an issue (with file input) where after the first file is ingested, followup files are ignored because… --- ## [Logstash email output filter not working with variable trigger key](https://discuss.elastic.co/t/logstash-email-output-filter-not-working-with-variable-trigger-key/163617)
**Author:** [@sureshkk252](https://discuss.elastic.co/u/sureshkk252)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 8:29pm UTC](https://discuss.elastic.co/t/logstash-email-output-filter-not-working-with-variable-trigger-key/163617 "2019-01-09T20:29:04Z")
Hi, I have configured logstash in a way we can dynamically configure the alert keyword which will send an email when it appears in message. My old configuration worked: I got emails when there is ERROR keyword in messag… --- ## [Dissect filter special character "\\" "\<"](https://discuss.elastic.co/t/dissect-filter-special-character/163571)
**Author:** [@Necus](https://discuss.elastic.co/u/Necus)\ **Replies:** 3\ **Last updated:** [January 9, 2019, 7:35pm UTC](https://discuss.elastic.co/t/dissect-filter-special-character/163571 "2019-01-09T19:35:32Z")
Hi, I'm trying to use the best of dissect, unfortunately i have encounter small problem with special characters like "" or "\<" For example: \<14\>Jan 9 15:36:03 and domain\_name\\username When i'm parsing this log wit… --- ## [How can I ignore or stop to load the headers from the '.tsv' file?](https://discuss.elastic.co/t/how-can-i-ignore-or-stop-to-load-the-headers-from-the-tsv-file/163579)
**Author:** [@surajbs](https://discuss.elastic.co/u/surajbs)\ **Replies:** 1\ **Last updated:** [January 9, 2019, 5:06pm UTC](https://discuss.elastic.co/t/how-can-i-ignore-or-stop-to-load-the-headers-from-the-tsv-file/163579 "2019-01-09T17:06:40Z")
I am using logstash to read '.tsv' file and load into elasticsearch, but it is even reading headers as a document/record. How can I ignore or stop to load the headers from the file ? Any suggestion would be helpful. T… --- ## [Logstash - Reference JSON files in a folder](https://discuss.elastic.co/t/logstash-reference-json-files-in-a-folder/163573)
**Author:** [@mgutier](https://discuss.elastic.co/u/mgutier)\ **Replies:** 1\ **Last updated:** [January 9, 2019, 4:59pm UTC](https://discuss.elastic.co/t/logstash-reference-json-files-in-a-folder/163573 "2019-01-09T16:59:35Z")
Trying to get a configuration going in Logstash where I can reference multiple JSON files from a folder and have it process them accordingly -- not sure if this is at all the correct way to go about this, here is what I … --- ## [Logstash Logging Warning](https://discuss.elastic.co/t/logstash-logging-warning/163583)
**Author:** [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)\ **Replies:** 1\ **Last updated:** [January 9, 2019, 4:37pm UTC](https://discuss.elastic.co/t/logstash-logging-warning/163583 "2019-01-09T16:37:41Z")
Hey there! Anyone knows why I'm getting these warnings? \[2019-01-09T16:16:02,231\]\[INFO \]\[org.logstash.beats.BeatsHandler\] \[local: 0.0.0.0:5044, remote: 172.18.213.2:42309\] Handling exception: event executor terminated … --- ## [Logstash Netflow Module : Could not index event to Elasticsearch netflow.application\_id](https://discuss.elastic.co/t/logstash-netflow-module-could-not-index-event-to-elasticsearch-netflow-application-id/162937)
**Author:** [@MikaMinn](https://discuss.elastic.co/u/MikaMinn)\ **Replies:** 2\ **Last updated:** [January 8, 2019, 2:35pm UTC](https://discuss.elastic.co/t/logstash-netflow-module-could-not-index-event-to-elasticsearch-netflow-application-id/162937 "2019-01-08T14:35:07Z")
Hi community :slight\_smile: I have recently install the netflow module. We have a cisco router and we try to collect netflow. I have follow this official guide . The installation was success. I don't have make anothe… --- ## [Running Logstash In The Cloud](https://discuss.elastic.co/t/running-logstash-in-the-cloud/163567)
**Author:** [@richardbritt](https://discuss.elastic.co/u/richardbritt)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 3:25pm UTC](https://discuss.elastic.co/t/running-logstash-in-the-cloud/163567 "2019-01-09T15:25:38Z")
Hi, I'm running the elasticSearch trial and I'm a little confused about Logstash. Is it possible to run it on the Elastic Cloud deployment? Is it expected that you host Logstash personally? Cheers, Richard Britt [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=619) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=621)