# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=626 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 627 --- ## [Using metadata in file input plugin and elasticsearch output plugin](https://discuss.elastic.co/t/using-metadata-in-file-input-plugin-and-elasticsearch-output-plugin/162375)
**Author:** [@James4](https://discuss.elastic.co/u/James4)\ **Replies:** 0\ **Last updated:** [December 28, 2018, 6:23pm UTC](https://discuss.elastic.co/t/using-metadata-in-file-input-plugin-and-elasticsearch-output-plugin/162375 "2018-12-28T18:23:24Z")
I could use some help using metadata in file input plugin and elasticsearch output plugin. I am trying to setup a single filter that provides configuration for the rest of my templates, for multiple test setups and prod… --- ## [Getting error illegal\_state\_exception in logstash](https://discuss.elastic.co/t/getting-error-illegal-state-exception-in-logstash/162372)
**Author:** [@Gaurav\_Rishi](https://discuss.elastic.co/u/Gaurav_Rishi)\ **Replies:** 0\ **Last updated:** [December 28, 2018, 5:16pm UTC](https://discuss.elastic.co/t/getting-error-illegal-state-exception-in-logstash/162372 "2018-12-28T17:16:47Z")
:09:33.849Z host1{ "MDC": {}, "API\_NAME": "FUND\_ORDER\_CLOSE", "EventTime" : "1546016973458", "TYPE" : "REQUEST", "REQUEST" : {"request":{"body":{"OrderId":"62","envInfo":{"clientIp":"106.208.59.212","terminalType":"WAP",… --- ## [Logstash Failed to Setup on Linux Mint 19](https://discuss.elastic.co/t/logstash-failed-to-setup-on-linux-mint-19/162185)
**Author:** [@peekr](https://discuss.elastic.co/u/peekr)\ **Replies:** 4\ **Last updated:** [December 28, 2018, 3:49pm UTC](https://discuss.elastic.co/t/logstash-failed-to-setup-on-linux-mint-19/162185 "2018-12-28T15:49:43Z")
Received an error upon: # apt-get install logstash Reading package lists... Done Building dependency tree Reading state information... Done The following NEW packages will be installed: logstash --------- Setti… --- ## [XML + Mutate plugins not working as espected](https://discuss.elastic.co/t/xml-mutate-plugins-not-working-as-espected/162271)
**Author:** [@Alfonso\_Diez](https://discuss.elastic.co/u/Alfonso_Diez)\ **Replies:** 2\ **Last updated:** [December 28, 2018, 12:56pm UTC](https://discuss.elastic.co/t/xml-mutate-plugins-not-working-as-espected/162271 "2018-12-28T12:56:28Z")
Hello. I've implement a filter where I read from a JMS queue a message that is an XML file. Then, I use the XML plugin to map some fields with the paths of the XML as following: xpath =\> \[ "//Framework\_Event/EventCo… --- ## [Cannot see data in elasticsearch](https://discuss.elastic.co/t/cannot-see-data-in-elasticsearch/162078)
**Author:** [@littlepython](https://discuss.elastic.co/u/littlepython)\ **Replies:** 1\ **Last updated:** [December 28, 2018, 12:40pm UTC](https://discuss.elastic.co/t/cannot-see-data-in-elasticsearch/162078 "2018-12-28T12:40:55Z")
2018-12-25 02:15:19,705 INFO - l.s.a.c.a.AdminController \[2-thread-1\] - entity version in hash map = 319 , entity version in couchbase = 319 skip updating entity since it's up-to-date: \_\_premiumFashionUtil\_\_nav\_bar 201… --- ## [ElasticSearch Logstash JDBC: How to aggregate into different column names](https://discuss.elastic.co/t/elasticsearch-logstash-jdbc-how-to-aggregate-into-different-column-names/162323)
**Author:** [@mpssantos](https://discuss.elastic.co/u/mpssantos)\ **Replies:** 3\ **Last updated:** [December 28, 2018, 12:31pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-jdbc-how-to-aggregate-into-different-column-names/162323 "2018-12-28T12:31:08Z")
I am new to Elasticsearch and I am trying to use Logstash to load data to an index. Following is a partial of my losgstash config: filter { aggregate { task\_id =\> "%{code}" code =\> " map\['campaignId'\] = … --- ## [How to add tags to the Document , based on the dictionary](https://discuss.elastic.co/t/how-to-add-tags-to-the-document-based-on-the-dictionary/162225)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 4\ **Last updated:** [December 28, 2018, 6:37am UTC](https://discuss.elastic.co/t/how-to-add-tags-to-the-document-based-on-the-dictionary/162225 "2018-12-28T06:37:40Z")
Hello Team, I am new to the ELK stack. I have a use case where I need to tag documents based on the dictionary. Where Dictionary key is String and value is list of Strings. So basically if the document field matches w… --- ## [Can't merge a non object mapping \[doc.xref.scenarios.scenario.examplesTable.tableTransformers.transformers\] with an object mapping \[doc.xref.scenarios.scenario.examplesTable.tableTransformers.transformers\]](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-doc-xref-scenarios-scenario-examplestable-tabletransformers-transformers-with-an-object-mapping-doc-xref-scenarios-scenario-examplestable-tabletransformers-transformers/162308)
**Author:** [@Neha1](https://discuss.elastic.co/u/Neha1)\ **Replies:** 0\ **Last updated:** [December 28, 2018, 7:19am UTC](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-doc-xref-scenarios-scenario-examplestable-tabletransformers-transformers-with-an-object-mapping-doc-xref-scenarios-scenario-examplestable-tabletransformers-transformers/162308 "2018-12-28T07:19:49Z")
Always getting this error while trying to index using logstash \[2018-12-28T10:39:45,549\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_ind… --- ## [How to solve spring metrics data (in json format ) in logstash](https://discuss.elastic.co/t/how-to-solve-spring-metrics-data-in-json-format-in-logstash/162293)
**Author:** [@AndyLin](https://discuss.elastic.co/u/AndyLin)\ **Replies:** 0\ **Last updated:** [December 28, 2018, 3:02am UTC](https://discuss.elastic.co/t/how-to-solve-spring-metrics-data-in-json-format-in-logstash/162293 "2018-12-28T03:02:14Z")
I was new to ELKB stack. I use http beat to get the metrics data from my spring boot app, and send it to logstash for solving. But I can not find any helpful info to solve my json data to the data I want for sending to… --- ## [Logstash if condition with multiple or's](https://discuss.elastic.co/t/logstash-if-condition-with-multiple-ors/162290)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 0\ **Last updated:** [December 28, 2018, 2:37am UTC](https://discuss.elastic.co/t/logstash-if-condition-with-multiple-ors/162290 "2018-12-28T02:37:53Z")
Is the below logstash syntax correct and mean the same? If \[id\] =="abc" and (\[table\] =="g" or \[table\] =="h") If \[id\] =="abc" and \[table\] in ("g", "h") --- ## [Howto convert this to a number?](https://discuss.elastic.co/t/howto-convert-this-to-a-number/161760)
**Author:** [@Ritten](https://discuss.elastic.co/u/Ritten)\ **Replies:** 2\ **Last updated:** [December 28, 2018, 12:41am UTC](https://discuss.elastic.co/t/howto-convert-this-to-a-number/161760 "2018-12-28T00:41:19Z")
Hi I have a field in Logstash that I can't convert. The field value is DKK82,334.25 and is a string that I need to convert into a number. I start by removing the DKK, and then I have tried to convert it into float and … --- ## [Logstash failing and restarting every 13 seconds](https://discuss.elastic.co/t/logstash-failing-and-restarting-every-13-seconds/161571)
**Author:** [@WilliamG](https://discuss.elastic.co/u/WilliamG)\ **Replies:** 6\ **Last updated:** [December 27, 2018, 7:54pm UTC](https://discuss.elastic.co/t/logstash-failing-and-restarting-every-13-seconds/161571 "2018-12-27T19:54:49Z")
The following error is occurring on one node in a three node elasticsearch/logstash cluster. It was functioning normally and apparently something changed recently (unaware of any work on the server at that time and not … --- ## [Adding additional geo\_point fields](https://discuss.elastic.co/t/adding-additional-geo-point-fields/162184)
**Author:** [@Kenneth\_M\_Kolano](https://discuss.elastic.co/u/Kenneth_M_Kolano)\ **Replies:** 2\ **Last updated:** [December 27, 2018, 6:40pm UTC](https://discuss.elastic.co/t/adding-additional-geo-point-fields/162184 "2018-12-27T18:40:35Z")
Hoping someone can assist with where I'm going wrong with adding two additional geoip/geo\_point fields. I've updated each of the default templates on Ubuntu to include the additional points, duplicating the pre-existing … --- ## [Log filtring issue](https://discuss.elastic.co/t/log-filtring-issue/162266)
**Author:** [@abinstephen1989](https://discuss.elastic.co/u/abinstephen1989)\ **Replies:** 1\ **Last updated:** [December 27, 2018, 4:57pm UTC](https://discuss.elastic.co/t/log-filtring-issue/162266 "2018-12-27T16:57:17Z")
Hi I have application log something likke...But when it is displaying in kibana it is not coming in same line. it is splitting at " at org" and displaying in different line, How can i make it display all log in same ti… --- ## [Greedydata doesn't accept backslash](https://discuss.elastic.co/t/greedydata-doesnt-accept-backslash/162032)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 2\ **Last updated:** [December 27, 2018, 4:14pm UTC](https://discuss.elastic.co/t/greedydata-doesnt-accept-backslash/162032 "2018-12-27T16:14:25Z")
Hi, My file has comma separated values. Values can contain backslash, curly braces , dot and quotes as well. I used GREEDYDATA but it throws grokparse failure error. It works fine when the entries doesn't contain backs… --- ## [Exporting data from logstash to neo4j](https://discuss.elastic.co/t/exporting-data-from-logstash-to-neo4j/162240)
**Author:** [@kkonkoly](https://discuss.elastic.co/u/kkonkoly)\ **Replies:** 0\ **Last updated:** [December 27, 2018, 1:38pm UTC](https://discuss.elastic.co/t/exporting-data-from-logstash-to-neo4j/162240 "2018-12-27T13:38:31Z")
Hello Everyone, this topic was here previously as https://discuss.elastic.co/t/neo4j-logstash-output-neo4j/50648 We are solving a use case where we'd benefit from sending some connected data via logstash into neo4j, bu… --- ## [Help in grok filter](https://discuss.elastic.co/t/help-in-grok-filter/162220)
**Author:** [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)\ **Replies:** 1\ **Last updated:** [December 27, 2018, 1:31pm UTC](https://discuss.elastic.co/t/help-in-grok-filter/162220 "2018-12-27T13:31:25Z")
Hello please help me find the suitable grok filter for IIS server the logs are logged as the following format : 2017-03-07 09:01:05 ::1 GET /Immatriculation/ImmatriculationPM/ImmatriculationPM - 5968 - ::1 Mozilla/5.0… --- ## [Failed to parse \[host\] error](https://discuss.elastic.co/t/failed-to-parse-host-error/161492)
**Author:** [@Ruthvik\_Sai](https://discuss.elastic.co/u/Ruthvik_Sai)\ **Replies:** 2\ **Last updated:** [December 27, 2018, 11:59am UTC](https://discuss.elastic.co/t/failed-to-parse-host-error/161492 "2018-12-27T11:59:54Z")
Hi, I am getting the following error when I am launching logstash. I have sending data from winlogbeat. \[2018-12-19T15:59:12,495\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>… --- ## [Logstash fails to load](https://discuss.elastic.co/t/logstash-fails-to-load/161305)
**Author:** [@geriberi](https://discuss.elastic.co/u/geriberi)\ **Replies:** 14\ **Last updated:** [December 27, 2018, 11:34am UTC](https://discuss.elastic.co/t/logstash-fails-to-load/161305 "2018-12-27T11:34:08Z")
Hi, i just tried to set up ELK on my win10 64 bit: java version "1.8.0\_191" Java(TM) SE Runtime Environment (build 1.8.0\_191-b12) Java HotSpot(TM) 64-Bit Server VM (build 25.191-b12, mixed mode) The packages for Ela… --- ## [Split into field nested array JSON](https://discuss.elastic.co/t/split-into-field-nested-array-json/162218)
**Author:** [@saif](https://discuss.elastic.co/u/saif)\ **Replies:** 0\ **Last updated:** [December 27, 2018, 9:49am UTC](https://discuss.elastic.co/t/split-into-field-nested-array-json/162218 "2018-12-27T09:49:18Z")
Hello, I want to parse this nested array JSON in logstash but no luck :frowning: "area": "aaa", "taskCode": "aaa", "appContext": \[ { "value": "aaa", "name": "source" }, { "value": "aaa", "name": "… --- ## [Logstash : Filter column values in a log](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862)
**Author:** [@Moulika\_Magatapalli1](https://discuss.elastic.co/u/Moulika_Magatapalli1)\ **Replies:** 5\ **Last updated:** [December 27, 2018, 7:35am UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862 "2018-12-27T07:35:34Z")
Hi , I am using Logstash to parse and filter the data. The input data looks something like this: Nov 28 23:00:31 Phase 0 ended (4 seconds) X Time X/S X/SK S/C 0… --- ## [Importing teamviewer logs getting started](https://discuss.elastic.co/t/importing-teamviewer-logs-getting-started/162176)
**Author:** [@JB\_Pollard](https://discuss.elastic.co/u/JB_Pollard)\ **Replies:** 2\ **Last updated:** [December 27, 2018, 4:25am UTC](https://discuss.elastic.co/t/importing-teamviewer-logs-getting-started/162176 "2018-12-27T04:25:37Z")
Just need a little direction just got everything installed and trying to read through the documentation. I want to import teamviewer logs into logstash and then get it to kibana. They way I understand it is filebeat is j… --- ## [Identify the records from input message for a failure output record](https://discuss.elastic.co/t/identify-the-records-from-input-message-for-a-failure-output-record/161844)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 3\ **Last updated:** [December 27, 2018, 1:51am UTC](https://discuss.elastic.co/t/identify-the-records-from-input-message-for-a-failure-output-record/161844 "2018-12-27T01:51:22Z")
Hi All I am running multiple pipelines in the 5.x instance. All the logs are getting accumulated in log file. This is well and good. There are scenarios where pipeline is not bringing records from input to output. The… --- ## [Using columns from two or more separate DB2 tables](https://discuss.elastic.co/t/using-columns-from-two-or-more-separate-db2-tables/162162)
**Author:** [@angelogabeira](https://discuss.elastic.co/u/angelogabeira)\ **Replies:** 0\ **Last updated:** [December 26, 2018, 4:17pm UTC](https://discuss.elastic.co/t/using-columns-from-two-or-more-separate-db2-tables/162162 "2018-12-26T16:17:36Z")
Folks, I'm trying to use data from two tables and I can not. follows the code: statement =\> " SELECT DISTINCT M1.CD\_UOR\_RSP\_SLC AS UOR, C2.NR\_PTL\_ATDT AS NR\_BB\_ATENDE FROM DB2BBR.MNFC\_PTL M1, DB2BBR.CNSO\_PAIN\_MNF… --- ## [Logstash 6.5.1 : undefined method \`path' for nil:NilClass](https://discuss.elastic.co/t/logstash-6-5-1-undefined-method-path-for-nil-nilclass/158708)
**Author:** [@gfigoni](https://discuss.elastic.co/u/gfigoni)\ **Replies:** 13\ **Last updated:** [December 26, 2018, 2:40pm UTC](https://discuss.elastic.co/t/logstash-6-5-1-undefined-method-path-for-nil-nilclass/158708 "2018-12-26T14:40:24Z")
I have an ELK stack installed on my workstation (windows 10). I recently migrated my ELK stack from v6.3.2 to the latest v6.5.1. On this local stack, I daily handle a fair amount of log files throw Logstash to Elastic. … --- ## [Xml filter array in field](https://discuss.elastic.co/t/xml-filter-array-in-field/162143)
**Author:** [@Lora\_Vl](https://discuss.elastic.co/u/Lora_Vl)\ **Replies:** 0\ **Last updated:** [December 26, 2018, 12:55pm UTC](https://discuss.elastic.co/t/xml-filter-array-in-field/162143 "2018-12-26T12:55:41Z")
Hello I have a XML file wich contains many elements, I played around with the XML filter for logstash wich only gives me 2 arrays I need to interconnect the two arrays. To eventually I want to get one field in which th… --- ## [Grok parse failure in LogStash, but works in Kibana debugger](https://discuss.elastic.co/t/grok-parse-failure-in-logstash-but-works-in-kibana-debugger/161746)
**Author:** [@swright-eti](https://discuss.elastic.co/u/swright-eti)\ **Replies:** 5\ **Last updated:** [December 26, 2018, 1:18pm UTC](https://discuss.elastic.co/t/grok-parse-failure-in-logstash-but-works-in-kibana-debugger/161746 "2018-12-26T13:18:18Z")
I have a pattern that the Grok Debugger in Kibana says works. Testing gives me the output I expect. However when run in Logstash I get a failure. Here is the log message I am trying to parse: DEBUG: 12/17/18 00:01:42.6… --- ## [Divided data to many index in output logstash](https://discuss.elastic.co/t/divided-data-to-many-index-in-output-logstash/162108)
**Author:** [@thachnv92](https://discuss.elastic.co/u/thachnv92)\ **Replies:** 1\ **Last updated:** [December 26, 2018, 10:08am UTC](https://discuss.elastic.co/t/divided-data-to-many-index-in-output-logstash/162108 "2018-12-26T10:08:33Z")
Hello, I want to config logstash to push in 2 index 1 day. If date time in logs between 00:00 to 11:59, I want to push it in index logstash-%YYYY.MM.dd-1. If date time in logs between 12:00 to 23:59, I want to push it… --- ## [Logstash error - "status"= 404](https://discuss.elastic.co/t/logstash-error-status-404/162076)
**Author:** [@Ram18](https://discuss.elastic.co/u/Ram18)\ **Replies:** 1\ **Last updated:** [December 26, 2018, 8:47am UTC](https://discuss.elastic.co/t/logstash-error-status-404/162076 "2018-12-26T08:47:37Z")
Hi, I am loading a csv file data into elasticsearch using Logstash. I have installed and configured all the necessary details in the Linux server. when I tried to run the config file to load the data, I am receiving the… --- ## [Http\_poller fingerprint 不起作用](https://discuss.elastic.co/t/http-poller-fingerprint/162098)
**Author:** [@375311384](https://discuss.elastic.co/u/375311384)\ **Replies:** 0\ **Last updated:** [December 26, 2018, 6:11am UTC](https://discuss.elastic.co/t/http-poller-fingerprint/162098 "2018-12-26T06:11:29Z")
大家好： 无法生成指纹字段，请帮助。配置文件如下： input { http\_poller { urls =\> { test2 =\> { method =\> post url =\> "http://\*.\*.\*.\*:\*\*\*\*/\*/save" body =\> { params =\> { "id" =\> "#{i… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=625) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=627)