# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=631 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 632 --- ## [Importing tweets CSV date parsing](https://discuss.elastic.co/t/importing-tweets-csv-date-parsing/161014)
**Author:** [@Gid](https://discuss.elastic.co/u/Gid)\ **Replies:** 1\ **Last updated:** [December 16, 2018, 8:39pm UTC](https://discuss.elastic.co/t/importing-tweets-csv-date-parsing/161014 "2018-12-16T20:39:57Z")
Hi all, Trying to import tweet data from Twitter's recently released archives and running into issues with date fields. The goal is to convert the tweet\_time field from the CSV as @timestamp to be used as time filter fi… --- ## [Json Filter](https://discuss.elastic.co/t/json-filter/160771)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 1\ **Last updated:** [December 16, 2018, 7:18pm UTC](https://discuss.elastic.co/t/json-filter/160771 "2018-12-16T19:18:58Z")
Hi, I have to parse a field which can be in a json format. is it possible to parse it if json and copy it in a field named json\_msg, or send it as text in a field named invalid\_json if it's an invalid json ? Thx for y… --- ## [Grok Filter Parsing Logs](https://discuss.elastic.co/t/grok-filter-parsing-logs/160777)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 2\ **Last updated:** [December 16, 2018, 5:19am UTC](https://discuss.elastic.co/t/grok-filter-parsing-logs/160777 "2018-12-16T05:19:38Z")
Hi- I have the unstructured logs receiving using the tcp input in Logstash: "win\_cpu,host=Test-Machine-01,instance=UCMS,objectname=Process Percent\_User\_Time=0,Percent\_Privileged\_Time=0 1544716850000000000\\n", I would … --- ## [Multiple outputs for single input](https://discuss.elastic.co/t/multiple-outputs-for-single-input/160910)
**Author:** [@Leo\_Kwok](https://discuss.elastic.co/u/Leo_Kwok)\ **Replies:** 2\ **Last updated:** [December 16, 2018, 5:25am UTC](https://discuss.elastic.co/t/multiple-outputs-for-single-input/160910 "2018-12-16T05:25:04Z")
At logstash, does it allow single input (from redis), with 2 different filters and outputs (to elasticsearch and email respectively? Thanks. --- ## [Grok pattern to format a special date and scientific notation number](https://discuss.elastic.co/t/grok-pattern-to-format-a-special-date-and-scientific-notation-number/160786)
**Author:** [@pad](https://discuss.elastic.co/u/pad)\ **Replies:** 1\ **Last updated:** [December 16, 2018, 1:22am UTC](https://discuss.elastic.co/t/grok-pattern-to-format-a-special-date-and-scientific-notation-number/160786 "2018-12-16T01:22:02Z")
Hi, I'm looking for two special patterns to convert a date with a special format and to convert a number with scientific notation. For the date, I've got this format yyyyMMdd\_hh:mm:ss (ex: 20181204\_10:50:07) For the s… --- ## [Logstash pipelines: "if \[fileset\]\[module\]" sometimes not working properly](https://discuss.elastic.co/t/logstash-pipelines-if-fileset-module-sometimes-not-working-properly/160999)
**Author:** [@MartijnS](https://discuss.elastic.co/u/MartijnS)\ **Replies:** 0\ **Last updated:** [December 15, 2018, 12:35pm UTC](https://discuss.elastic.co/t/logstash-pipelines-if-fileset-module-sometimes-not-working-properly/160999 "2018-12-15T12:35:42Z")
Hello, Since a week or so I'm trying Elastic to determine wether or not it's something we can use at work (webhosting company). I've got it all setup (filebeat and metricbeat, Logstash, Elastic and Kibana). Within Logst… --- ## [Having a really hard time mutating XML Filter Results](https://discuss.elastic.co/t/having-a-really-hard-time-mutating-xml-filter-results/160929)
**Author:** [@abablitz](https://discuss.elastic.co/u/abablitz)\ **Replies:** 2\ **Last updated:** [December 15, 2018, 5:27am UTC](https://discuss.elastic.co/t/having-a-really-hard-time-mutating-xml-filter-results/160929 "2018-12-15T05:27:53Z")
figured it out xpath. --- ## [Error Logstash](https://discuss.elastic.co/t/error-logstash/160949)
**Author:** [@Jhonatan\_R](https://discuss.elastic.co/u/Jhonatan_R)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 6:01pm UTC](https://discuss.elastic.co/t/error-logstash/160949 "2018-12-14T18:01:23Z")
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at p… --- ## [TLS enabled in logstash . NO certificates for Filebeat. Is it possible to connect](https://discuss.elastic.co/t/tls-enabled-in-logstash-no-certificates-for-filebeat-is-it-possible-to-connect/160337)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 9:13pm UTC](https://discuss.elastic.co/t/tls-enabled-in-logstash-no-certificates-for-filebeat-is-it-possible-to-connect/160337 "2018-12-14T21:13:04Z")
HI All , TLS enabled in logstash . But i dont have any certificates for filebeat. Is it possible to connect filebeat to a TLS enabled logstash without a certificate. I have certificates for logssash and certificate au… --- ## [Configuring filebeat logstash plugin to transform one log, but not another](https://discuss.elastic.co/t/configuring-filebeat-logstash-plugin-to-transform-one-log-but-not-another/160945)
**Author:** [@swright-eti](https://discuss.elastic.co/u/swright-eti)\ **Replies:** 7\ **Last updated:** [December 14, 2018, 8:59pm UTC](https://discuss.elastic.co/t/configuring-filebeat-logstash-plugin-to-transform-one-log-but-not-another/160945 "2018-12-14T20:59:10Z")
I have hosts that have log files in different formats, Vision, and Triad. They are being collected by Filebeat and shipped to Logstash. I have a Logstash config file setup for Beats as shown in the docs. At this point it… --- ## [Windows Logstash 6.5.0: pipelines.yml: path.config no longer working](https://discuss.elastic.co/t/windows-logstash-6-5-0-pipelines-yml-path-config-no-longer-working/160969)
**Author:** [@Matt\_Vasquez](https://discuss.elastic.co/u/Matt_Vasquez)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 8:31pm UTC](https://discuss.elastic.co/t/windows-logstash-6-5-0-pipelines-yml-path-config-no-longer-working/160969 "2018-12-14T20:31:19Z")
So since I upgraded from 6.4.3 to 6.5.0 I cannot run a pipline with the windows version of Logstash 6.5.0. I have a feeling it has to do with the forward slash "/" vs back slash "\\" in the file paths since windows and L… --- ## [TypeError: no implicit conversion from nil to integer](https://discuss.elastic.co/t/typeerror-no-implicit-conversion-from-nil-to-integer/160950)
**Author:** [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 6:21pm UTC](https://discuss.elastic.co/t/typeerror-no-implicit-conversion-from-nil-to-integer/160950 "2018-12-14T18:21:18Z")
I am getting this error and I am not able to understand what it means. i am parsing CISCO ASA logs and I am getting this error. Below is my config file. input { file { path =\> "/⁨Users⁩/samvidkulkarni⁩/Desk… --- ## [Logstash Cannot Find Java (I know, it's common, but)](https://discuss.elastic.co/t/logstash-cannot-find-java-i-know-its-common-but/160774)
**Author:** [@Aralex](https://discuss.elastic.co/u/Aralex)\ **Replies:** 3\ **Last updated:** [December 14, 2018, 4:33pm UTC](https://discuss.elastic.co/t/logstash-cannot-find-java-i-know-its-common-but/160774 "2018-12-14T16:33:04Z")
Hi, this seems to be a quite common issue many people face. I exhausted every single resource I could find on the topic with all suggested solutions, none worked for me. I probably am missing something tiny in some file… --- ## [Use of keyword 'else' causes error "Couldn't find any filter plugin named 'else'."](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988)
**Author:** [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\ **Replies:** 3\ **Last updated:** [December 14, 2018, 3:28pm UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988 "2018-12-14T15:28:15Z")
I have the following code in my filter. The construct, if ... else if ... else are described by Logstash documentation as being valid yet /var/log/logstash/logstash-plain.log records this error message. filter { if \[s… --- ## [Csv upload error in logstash](https://discuss.elastic.co/t/csv-upload-error-in-logstash/159127)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 19\ **Last updated:** [December 14, 2018, 2:42pm UTC](https://discuss.elastic.co/t/csv-upload-error-in-logstash/159127 "2018-12-14T14:42:25Z")
Hi All, We are been trying to upload csv into elasticsearch through logstash and have stuck up with an issue. The excel has a lot of special characters having that in place we cant upload the document into elasticsearch… --- ## [Charc Set in Logstash](https://discuss.elastic.co/t/charc-set-in-logstash/160907)
**Author:** [@Carlos\_Magalhaes](https://discuss.elastic.co/u/Carlos_Magalhaes)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 1:17pm UTC](https://discuss.elastic.co/t/charc-set-in-logstash/160907 "2018-12-14T13:17:19Z")
Hi all, Finally got some grok filters working well for some custom snort logs. Quite often it fails due to the fact that in the message or the entire message has what I assume is either: Some unknown ASCII Charc Encry… --- ## [Logs not stored correctly in ES](https://discuss.elastic.co/t/logs-not-stored-correctly-in-es/160903)
**Author:** [@jeromepin](https://discuss.elastic.co/u/jeromepin)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 12:24pm UTC](https://discuss.elastic.co/t/logs-not-stored-correctly-in-es/160903 "2018-12-14T12:24:33Z")
Hello, Since a few days, my ELK+Fluentd stack stopped working as usual and I cannot find the source of my problem. I'm using : Logstash 6.5.3-1 Filebeat version 6.4.0 (amd64), libbeat 6.4.0 Elasticsearch 6.5 My logs … --- ## [Logstash http batching output](https://discuss.elastic.co/t/logstash-http-batching-output/160897)
**Author:** [@vissu](https://discuss.elastic.co/u/vissu)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 11:50am UTC](https://discuss.elastic.co/t/logstash-http-batching-output/160897 "2018-12-14T11:50:37Z")
Hi Team, https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html While using logstash-output-http plugin , We can select the format to be "json\_batch". How can we control this batch. For example how… --- ## [How to push data from Vertica to logstash](https://discuss.elastic.co/t/how-to-push-data-from-vertica-to-logstash/160890)
**Author:** [@raj.teaser](https://discuss.elastic.co/u/raj.teaser)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 11:11am UTC](https://discuss.elastic.co/t/how-to-push-data-from-vertica-to-logstash/160890 "2018-12-14T11:11:34Z")
How to push data from Vertica to logstash? Or How to connect from Vertica to logstash? --- ## [Error to map date field with format yyyy-MM-dd HH:mm:ss.SSS](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341)
**Author:** [@balumurari1](https://discuss.elastic.co/u/balumurari1)\ **Replies:** 9\ **Last updated:** [December 14, 2018, 10:05am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341 "2018-12-14T10:05:07Z")
Hello, can anyone help me to map the date, 2018-12-03 06:00:00.000 I have tried to give mapping to load into logstash as yyyy-MM-dd HH:mm:ss.SSS but getting below error "error"=\>{"type"=\>"mapper\_parsing\_exception", … --- ## [Merge multiple lines with a specific condition](https://discuss.elastic.co/t/merge-multiple-lines-with-a-specific-condition/160755)
**Author:** [@imaad](https://discuss.elastic.co/u/imaad)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 10:03am UTC](https://discuss.elastic.co/t/merge-multiple-lines-with-a-specific-condition/160755 "2018-12-14T10:03:15Z")
Hello, Is there any way to group by 5 lines using the multiline codec plugin or with another tool? My file log look like this : 2018-11-23 07:55:52 Regulatory \[INFO\] Account : A,B,100002506,23/11/2018,23/11/2018 07:55… --- ## [Field is filled in stdout but empty in elasticsearch](https://discuss.elastic.co/t/field-is-filled-in-stdout-but-empty-in-elasticsearch/160760)
**Author:** [@lokylax](https://discuss.elastic.co/u/lokylax)\ **Replies:** 2\ **Last updated:** [December 14, 2018, 7:28am UTC](https://discuss.elastic.co/t/field-is-filled-in-stdout-but-empty-in-elasticsearch/160760 "2018-12-14T07:28:21Z")
Hi everyone I am new to elastic stack and I am trying to parse multiline logs for the first time. (like this) 2018-06-04 13:42:01,436 INFO (main) \[en.vke.ultil.ServerStateChecker\] - Server is not ready yet : Could n… --- ## [How to filter out kernel messages by logstash?](https://discuss.elastic.co/t/how-to-filter-out-kernel-messages-by-logstash/160746)
**Author:** [@rishi\_shah](https://discuss.elastic.co/u/rishi_shah)\ **Replies:** 3\ **Last updated:** [December 14, 2018, 7:53am UTC](https://discuss.elastic.co/t/how-to-filter-out-kernel-messages-by-logstash/160746 "2018-12-14T07:53:52Z")
I am using following logstash config to monitor our user SSH events on remote machines. I am using filebeat to send syslogs from all the servers to our ELK server. I only want user events. I want to ignore all networking… --- ## [I want replace severity\_label with INFO instead of NOTICE](https://discuss.elastic.co/t/i-want-replace-severity-label-with-info-instead-of-notice/160860)
**Author:** [@naga\_kunchala](https://discuss.elastic.co/u/naga_kunchala)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 7:47am UTC](https://discuss.elastic.co/t/i-want-replace-severity-label-with-info-instead-of-notice/160860 "2018-12-14T07:47:33Z")
hi , I am receiving bulk of 'NOTICE' alerts from my logs, so i want to modify that logs as INFO instead of NOTICE. for this i am using the below filter if \[program\] == "logstash\_alerts" and "Error getting for log" in \[… --- ## [Logstash startup failed with missing jar](https://discuss.elastic.co/t/logstash-startup-failed-with-missing-jar/160579)
**Author:** [@hubo3085632](https://discuss.elastic.co/u/hubo3085632)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 6:07am UTC](https://discuss.elastic.co/t/logstash-startup-failed-with-missing-jar/160579 "2018-12-14T06:07:26Z")
Hi all, i met a issue when i run logstash on mac,env jdk11,here is the exception: Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (LoadError) load error: manticore -- java.l… --- ## [Azure Config](https://discuss.elastic.co/t/azure-config/160839)
**Author:** [@nrupaks](https://discuss.elastic.co/u/nrupaks)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 5:11am UTC](https://discuss.elastic.co/t/azure-config/160839 "2018-12-14T05:11:50Z")
Hi, I am trying to configure logstash instance to read logs from an event hub, but I am getting a consistent error, i.e. Eventhub is closed. Any idea/suggestions of what could be the cause of the error? Thanks, ND --- ## [How to determine when dissect fails and branch to try a different dissect clause?](https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824)
**Author:** [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\ **Replies:** 4\ **Last updated:** [December 13, 2018, 3:58pm UTC](https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824 "2018-12-13T15:58:32Z")
When a dissect clause pattern fails to match the message in hand, it would be nice to try another. This arises in the case where the distinction between log entries cannot be discriminated via any available condition. I… --- ## [Random newlines when using multiline-codec in tcp input](https://discuss.elastic.co/t/random-newlines-when-using-multiline-codec-in-tcp-input/160321)
**Author:** [@shkwarka](https://discuss.elastic.co/u/shkwarka)\ **Replies:** 1\ **Last updated:** [December 13, 2018, 3:10pm UTC](https://discuss.elastic.co/t/random-newlines-when-using-multiline-codec-in-tcp-input/160321 "2018-12-13T15:10:17Z")
Hello, I'm trying to process multiline messages received from rsyslog as a plain text over TCP with multiline codec in tcp input. In output for some messages i noticed parsing failed because Logstash inserted randomly "… --- ## [Importing MySql rows with existing timestamp when not stored as UTC](https://discuss.elastic.co/t/importing-mysql-rows-with-existing-timestamp-when-not-stored-as-utc/160615)
**Author:** [@wgehalo](https://discuss.elastic.co/u/wgehalo)\ **Replies:** 1\ **Last updated:** [December 13, 2018, 3:07pm UTC](https://discuss.elastic.co/t/importing-mysql-rows-with-existing-timestamp-when-not-stored-as-utc/160615 "2018-12-13T15:07:23Z")
I've been searching around and can't seem to find an answer to this. I have a MySql database which I am importing via logstash, which has an existing timestamp field called "receivetime". This is the field I want to use… --- ## [Can't get geoip to work](https://discuss.elastic.co/t/cant-get-geoip-to-work/160577)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 11\ **Last updated:** [December 13, 2018, 1:51pm UTC](https://discuss.elastic.co/t/cant-get-geoip-to-work/160577 "2018-12-13T13:51:30Z")
All, Despite many, many attempts, I've not been able to make geoip work. I don't see the "clientip" field in any of my indices, nor is geoip an option when trying to create a Coordinate Map | Geo Coordinates Bucket | A… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=630) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=632)