# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=621 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 622 --- ## [Logstash Error: address already in use issue](https://discuss.elastic.co/t/logstash-error-address-already-in-use-issue/163561)
**Author:** [@sreekaanth](https://discuss.elastic.co/u/sreekaanth)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 3:06pm UTC](https://discuss.elastic.co/t/logstash-error-address-already-in-use-issue/163561 "2019-01-09T15:06:29Z")
I am trying to start logstash with bin/logstash -f logstash.conf. However I am getting error: address already in use. Checked netstat -an | grep :5044 and I end up getting only the logstash process using that port. How … --- ## [Logstash filter: find all occurrences and put in array](https://discuss.elastic.co/t/logstash-filter-find-all-occurrences-and-put-in-array/163412)
**Author:** [@agosmaker](https://discuss.elastic.co/u/agosmaker)\ **Replies:** 2\ **Last updated:** [January 9, 2019, 2:21pm UTC](https://discuss.elastic.co/t/logstash-filter-find-all-occurrences-and-put-in-array/163412 "2019-01-09T14:21:28Z")
Hello, For example we have some log string: 2019-01-08 01:00:10 INFO Emails were sent from some@domain.com to a@domain.com, b@domain.com. The topic is cool. c@domain.com is ignored. Is there a way to find and put all … --- ## [Logstash change log directory](https://discuss.elastic.co/t/logstash-change-log-directory/163512)
**Author:** [@sledge13](https://discuss.elastic.co/u/sledge13)\ **Replies:** 1\ **Last updated:** [January 9, 2019, 1:36pm UTC](https://discuss.elastic.co/t/logstash-change-log-directory/163512 "2019-01-09T13:36:38Z")
Hello, i have installed Logstash on Ubuntu Server 16.04, mounted 1 TB harddrive, and i would like to change directory of all saved logs to this harddrive. How can I change it? Do i need to edit some config file? Thanks --- ## [Timestamp out of UNIXpath](https://discuss.elastic.co/t/timestamp-out-of-unixpath/163374)
**Author:** [@humalog](https://discuss.elastic.co/u/humalog)\ **Replies:** 6\ **Last updated:** [January 9, 2019, 1:28pm UTC](https://discuss.elastic.co/t/timestamp-out-of-unixpath/163374 "2019-01-09T13:28:59Z")
Hello, i try to get a new timestamp which i want to read from a unixpath. I tested with the Grok Debugger. I got smth. what worked, but I think there are better solutions for this. My sample data: /home/user/file.1.20… --- ## [Logstash filter - error](https://discuss.elastic.co/t/logstash-filter-error/162665)
**Author:** [@Ravi\_Khurana](https://discuss.elastic.co/u/Ravi_Khurana)\ **Replies:** 2\ **Last updated:** [January 9, 2019, 1:04pm UTC](https://discuss.elastic.co/t/logstash-filter-error/162665 "2019-01-09T13:04:45Z")
Hi team, i am new on ELK stack, and i was trying to read log (given below) through filter, kindly help to write the filter on the below log, 2018-08-25 14:14:29,026 \[http-nio-8085-exec-458\] INFO com..cdb.utils.Utils - … --- ## [Logstash is not parsing all logs](https://discuss.elastic.co/t/logstash-is-not-parsing-all-logs/163530)
**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 12:47pm UTC](https://discuss.elastic.co/t/logstash-is-not-parsing-all-logs/163530 "2019-01-09T12:47:48Z")
Hi, I have implemented simple filter, just to add a tag to the logs, filter: filter { if \[src\] == "source\_syslog" { mutate { add\_tag =\> \[ "beparsed" \] } } } output { elasticsearch { index =\> "logstash-%{+xxxx.… --- ## [Indexing becomes slow when I start indexing data to two Elasticsearch cluster simultaneously](https://discuss.elastic.co/t/indexing-becomes-slow-when-i-start-indexing-data-to-two-elasticsearch-cluster-simultaneously/161989)
**Author:** [@vkeswarlal](https://discuss.elastic.co/u/vkeswarlal)\ **Replies:** 4\ **Last updated:** [January 9, 2019, 12:29pm UTC](https://discuss.elastic.co/t/indexing-becomes-slow-when-i-start-indexing-data-to-two-elasticsearch-cluster-simultaneously/161989 "2019-01-09T12:29:31Z")
Hi, We are using Logstash to read log data from redis and index it to Elasticsearch 1.7.9. We are in the process of upgrading the Elasticsearch to version 6.5.1, so we have set up a ES6.5 cluster of 11 nodes ( 3:master,… --- ## [Error with config file](https://discuss.elastic.co/t/error-with-config-file/163471)
**Author:** [@cythwell](https://discuss.elastic.co/u/cythwell)\ **Replies:** 3\ **Last updated:** [January 9, 2019, 10:02am UTC](https://discuss.elastic.co/t/error-with-config-file/163471 "2019-01-09T10:02:00Z")
The config file like: input { http { port =\> 20020 } filter { mutate { rename =\> \["shortHostname", "hostname" \] } } output { if \[usageReports\]\[level\] == "top" { elasticsearch { action =\> "update" doc\_as\_ups… --- ## [Issue With logsatsh ssl configuration](https://discuss.elastic.co/t/issue-with-logsatsh-ssl-configuration/163494)
**Author:** [@Aslamfarook](https://discuss.elastic.co/u/Aslamfarook)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 9:39am UTC](https://discuss.elastic.co/t/issue-with-logsatsh-ssl-configuration/163494 "2019-01-09T09:39:32Z")
Hi Team, I am trying to connect my winlogbeat agent to ubuntu ELK with logstash by ssl authentication Here is my winlogbeat.yml #################################################### winlogbeat.event\_logs: name: Appl… --- ## [Bug: ruby filter does not work with certain input plugin combination](https://discuss.elastic.co/t/bug-ruby-filter-does-not-work-with-certain-input-plugin-combination/163493)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 9:29am UTC](https://discuss.elastic.co/t/bug-ruby-filter-does-not-work-with-certain-input-plugin-combination/163493 "2019-01-09T09:29:13Z")
Here is an example where ruby filter breaks down. ruby filter is not working when input ishttp. but same ruby filter working when the input is CSV. does anyone have any idea on this input { http\_poller{ urls =\>… --- ## [Logstash Plugin es\_bulk - Need a working exampleof bulk indexing](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 7\ **Last updated:** [January 9, 2019, 8:50am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530 "2019-01-09T08:50:26Z")
We are currently posting multiple events to Elastic Search using the /\_bulk endpoint in the format: {"index":{"\_type" : "doc", "\_id": "1"}} {"category":"DATA","raw": "message 1"} {"index":{"\_type" : "doc", "\_id": "2"}} … --- ## [@timestamp is not matching the actual event time from the router syslog](https://discuss.elastic.co/t/timestamp-is-not-matching-the-actual-event-time-from-the-router-syslog/163163)
**Author:** [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Replies:** 8\ **Last updated:** [January 9, 2019, 8:23am UTC](https://discuss.elastic.co/t/timestamp-is-not-matching-the-actual-event-time-from-the-router-syslog/163163 "2019-01-09T08:23:03Z")
elasticsearch is creating indexes with a future date. @timestamp is not matching the actual event time from the router syslog . The actual event time is Nov 30 2018. Could anyone tell me why the index and @timestamp is … --- ## [Custom header with a ISO-8601 format in the logstash http\_poller input](https://discuss.elastic.co/t/custom-header-with-a-iso-8601-format-in-the-logstash-http-poller-input/163470)
**Author:** [@ash74268](https://discuss.elastic.co/u/ash74268)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 8:09am UTC](https://discuss.elastic.co/t/custom-header-with-a-iso-8601-format-in-the-logstash-http-poller-input/163470 "2019-01-09T08:09:19Z")
Is there a way to generate a header with ISO-8601 time when using http\_poller input plugin? e.g: input { http\_poller { urls =\> { notification =\> { method =\> get url =\> "http://host:port/api" headers =\> { "Conten… --- ## [Logstash mutate string to JSON](https://discuss.elastic.co/t/logstash-mutate-string-to-json/163466)
**Author:** [@ale.bollicino](https://discuss.elastic.co/u/ale.bollicino)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 7:48am UTC](https://discuss.elastic.co/t/logstash-mutate-string-to-json/163466 "2019-01-09T07:48:26Z")
Hi all, I have a Logstash installation that read JSON data from a Redis cache and send the events to an Elastic. Configuration it's very simple: input { redis { host =\> "my-redis" data\_type =\> "list" port =\> "638… --- ## [Does logstash support snmpv3 traps](https://discuss.elastic.co/t/does-logstash-support-snmpv3-traps/163465)
**Author:** [@amolj](https://discuss.elastic.co/u/amolj)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 7:39am UTC](https://discuss.elastic.co/t/does-logstash-support-snmpv3-traps/163465 "2019-01-09T07:39:08Z")
does logstash support snmpv3 traps ? if yes, what configuration we need to set ? --- ## [Winlogbeat can’t start the service with tls enable](https://discuss.elastic.co/t/winlogbeat-can-t-start-the-service-with-tls-enable/163449)
**Author:** [@alexlu](https://discuss.elastic.co/u/alexlu)\ **Replies:** 0\ **Last updated:** [January 9, 2019, 3:50am UTC](https://discuss.elastic.co/t/winlogbeat-can-t-start-the-service-with-tls-enable/163449 "2019-01-09T03:50:34Z")
The error message: PS C:\\Users\\alex\\Downloads\\winlogbeat\> Start-Service winlogbeat Start-Service : Service 'winlogbeat (winlogbeat)' cannot be started due to the following error: Cannot start service winlogbeat on com… --- ## [Get "\_dateparsefailure" when use Elasticsearch input plugin](https://discuss.elastic.co/t/get-dateparsefailure-when-use-elasticsearch-input-plugin/163357)
**Author:** [@occultskyrong](https://discuss.elastic.co/u/occultskyrong)\ **Replies:** 1\ **Last updated:** [January 9, 2019, 3:01am UTC](https://discuss.elastic.co/t/get-dateparsefailure-when-use-elasticsearch-input-plugin/163357 "2019-01-09T03:01:28Z")
I just use Elasticsearch input plugin like this : input { elasticsearch { hosts =\> "localhost:9200" index =\> "test" query =\> "" size =\> 1 scroll =\> "300s" docinfo =\> true } } and then , i u… --- ## [Logstash file output plugin injecting extra characters into events](https://discuss.elastic.co/t/logstash-file-output-plugin-injecting-extra-characters-into-events/161603)
**Author:** [@ohhellno](https://discuss.elastic.co/u/ohhellno)\ **Replies:** 3\ **Last updated:** [January 9, 2019, 2:07am UTC](https://discuss.elastic.co/t/logstash-file-output-plugin-injecting-extra-characters-into-events/161603 "2019-01-09T02:07:48Z")
hi there we are using logstash for logging syslog events to file and forward to elastic. Our configs are s follows: input { syslog { id =\> "Syslog\_Data" port =\> 5514 type =\> syslog … --- ## [Filtering data to different indexes based on source iP](https://discuss.elastic.co/t/filtering-data-to-different-indexes-based-on-source-ip/163352)
**Author:** [@Necus](https://discuss.elastic.co/u/Necus)\ **Replies:** 1\ **Last updated:** [January 8, 2019, 10:52pm UTC](https://discuss.elastic.co/t/filtering-data-to-different-indexes-based-on-source-ip/163352 "2019-01-08T22:52:48Z")
Hi, How can I filter data from different IP addresses to different indexes on the same elastic search. Sample below: input { udp { port =\> 514 type =\> syslog } } filter { } output { elasticsearch { h… --- ## [Logstash require 'sqlite3'](https://discuss.elastic.co/t/logstash-require-sqlite3/163309)
**Author:** [@pohsun.teh](https://discuss.elastic.co/u/pohsun.teh)\ **Replies:** 8\ **Last updated:** [January 8, 2019, 10:38pm UTC](https://discuss.elastic.co/t/logstash-require-sqlite3/163309 "2019-01-08T22:38:45Z")
When I run my logstash, error shown no such file to load -- sqlite3 Is it because sqlite3 is not pre-installed with Logstash? Is it possible to install sqlite3 for logstash? gem install sqlite3 Reason being is t… --- ## [Correct use of dissect](https://discuss.elastic.co/t/correct-use-of-dissect/163438)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 1\ **Last updated:** [January 8, 2019, 10:21pm UTC](https://discuss.elastic.co/t/correct-use-of-dissect/163438 "2019-01-08T22:21:17Z")
I've coded my input for some FW logs. I initially sent those logs to a simple syslog server so I could code my config for it. The syslog input looks like this: 10.50.255.34 Jan 8 13:38:09 firewall.hostname.com user info… --- ## [Help with grokking when the logs aren't of a definite format](https://discuss.elastic.co/t/help-with-grokking-when-the-logs-arent-of-a-definite-format/163353)
**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Replies:** 3\ **Last updated:** [January 8, 2019, 9:09pm UTC](https://discuss.elastic.co/t/help-with-grokking-when-the-logs-arent-of-a-definite-format/163353 "2019-01-08T21:09:20Z")
Hi, I have stream of logs coming in and I ship them using filebeat to logstash. One such event looks like this 1545371943.464899 IP 92.42.189.139.80 \> 185.234.217.231.55618: Flags \[P.\], seq 1:513, ack 172, win 260, op… --- ## [Dynamic xpath creation by parsing fields in Xml filter](https://discuss.elastic.co/t/dynamic-xpath-creation-by-parsing-fields-in-xml-filter/163363)
**Author:** [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Replies:** 15\ **Last updated:** [January 8, 2019, 7:09pm UTC](https://discuss.elastic.co/t/dynamic-xpath-creation-by-parsing-fields-in-xml-filter/163363 "2019-01-08T19:09:45Z")
Below is the sample xml \ \ \ \http://10.115.88.123:88/category/view\ \ \ \ \ **Author:** [@saad](https://discuss.elastic.co/u/saad)\ **Replies:** 0\ **Last updated:** [January 8, 2019, 6:48pm UTC](https://discuss.elastic.co/t/sending-windows-security-logs-to-logstash/163425 "2019-01-08T18:48:13Z") We dont want install beats in windows AD server to send the logs to elasticsearch. Can I send the logs from the windows server toward logstash? and How the logs will be if we sent it in this way? --- ## [GeoIP Issues with 6.5.4](https://discuss.elastic.co/t/geoip-issues-with-6-5-4/163281)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [January 8, 2019, 5:42pm UTC](https://discuss.elastic.co/t/geoip-issues-with-6-5-4/163281 "2019-01-08T17:42:21Z")
Update: Looks like there is an issue with the geoip filter in Logstash 6.5.4. My existing pipeline worked fine up until the upgrade from 6.4.1 and now I get the below error. Commenting out my simple geoip config resul… --- ## [Unique entries in JDBC](https://discuss.elastic.co/t/unique-entries-in-jdbc/163415)
**Author:** [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Replies:** 0\ **Last updated:** [January 8, 2019, 5:40pm UTC](https://discuss.elastic.co/t/unique-entries-in-jdbc/163415 "2019-01-08T17:40:33Z")
Hello, I'm trying to create an Elasticsearch index using JDBC plugin to read data from SQL Server. I have configured it to read my data at 2AM every day. However, what happens if the system goes down at 2:05AM, having … --- ## [Multiline grok](https://discuss.elastic.co/t/multiline-grok/162341)
**Author:** [@Pierre2](https://discuss.elastic.co/u/Pierre2)\ **Replies:** 1\ **Last updated:** [January 8, 2019, 4:19pm UTC](https://discuss.elastic.co/t/multiline-grok/162341 "2019-01-08T16:19:37Z")
Hello, I have a problem. This is how my log looks like : dn: cn=groupe1,cn=Groups,cn=8770 administration,o=nmc groupname: groupe1 displayname: groupe1 objectclass: top objectclass: groupOfUniqueNames objectclass:… --- ## [Thinkbox Deadline with Logstash Elasticsearch](https://discuss.elastic.co/t/thinkbox-deadline-with-logstash-elasticsearch/163402)
**Author:** [@gsuboc](https://discuss.elastic.co/u/gsuboc)\ **Replies:** 0\ **Last updated:** [January 8, 2019, 4:11pm UTC](https://discuss.elastic.co/t/thinkbox-deadline-with-logstash-elasticsearch/163402 "2019-01-08T16:11:25Z")
Hello, Does anyone knows how to connect Thinkbox Deadline rendering management to ELK? --- ## [Filtering question](https://discuss.elastic.co/t/filtering-question/163241)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 10\ **Last updated:** [January 8, 2019, 4:07pm UTC](https://discuss.elastic.co/t/filtering-question/163241 "2019-01-08T16:07:23Z")
I have the following output, as viewed in Kibana: { "\_index": "filebeat-6.5.4-2019.01.07", "\_type": "doc", "\_id": "KoIlKWgBCwfgisRVoVxm", "\_version": 1, "\_score": null, "\_source": { "offset": 159112, "prospecto… --- ## [Use Logstash CSV module to move columns](https://discuss.elastic.co/t/use-logstash-csv-module-to-move-columns/163383)
**Author:** [@Hamil](https://discuss.elastic.co/u/Hamil)\ **Replies:** 2\ **Last updated:** [January 8, 2019, 3:57pm UTC](https://discuss.elastic.co/t/use-logstash-csv-module-to-move-columns/163383 "2019-01-08T15:57:37Z")
I am using Logstash to grab a file from a monitored folder to import my Symantec WSS (Bluecoat) Cloud Proxy logs. I have looked at and used the information from the following two old (but still very useful) websites: … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=620) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=622)