# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=639 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 640 --- ## [Normalize IBAN to DE89 3704 0044 0532 0130 00](https://discuss.elastic.co/t/normalize-iban-to-de89-3704-0044-0532-0130-00/159227)
**Author:** [@ravian100](https://discuss.elastic.co/u/ravian100)\ **Replies:** 2\ **Last updated:** [December 3, 2018, 7:47pm UTC](https://discuss.elastic.co/t/normalize-iban-to-de89-3704-0044-0532-0130-00/159227 "2018-12-03T19:47:42Z")
I want to normalize IBAN from DE89370400440532013000 to DE89 3704 0044 0532 0130 00. any idea using split or grok mutate filter --- ## [Modifying Output Time in File Plugin](https://discuss.elastic.co/t/modifying-output-time-in-file-plugin/159223)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 5:08pm UTC](https://discuss.elastic.co/t/modifying-output-time-in-file-plugin/159223 "2018-12-03T17:08:48Z")
Using the file plugin to output processed data to a .gzip file. I am using the time in YYYYMMdd-H format to create a new file every hour. However, the hour that is being used is UTC time. Is it possible to pull the ho… --- ## [Need help in parsing DMARC report in XML format](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 9\ **Last updated:** [December 3, 2018, 5:05pm UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446 "2018-12-03T17:05:15Z")
Hi team, I am receiving XML report for our domain in XML formar and wanted to know if it can parsed using logstash so that data can be visualized in Kibana? Please suggest. --- ## [Does bulk insert works well with multiples inputs?](https://discuss.elastic.co/t/does-bulk-insert-works-well-with-multiples-inputs/158755)
**Author:** [@alan.santos](https://discuss.elastic.co/u/alan.santos)\ **Replies:** 7\ **Last updated:** [December 3, 2018, 5:03pm UTC](https://discuss.elastic.co/t/does-bulk-insert-works-well-with-multiples-inputs/158755 "2018-12-03T17:03:06Z")
Hi all, My scenario: Kafka-input 5.1.11 LS 5.6 ES 2.2 Number of topics: 110 (and increasing) Number of shard per index (original data): 2 Number of shard per index (modifed data): 1 Number of shards: ~37167 Numb… --- ## [Could not index event to Elasticsearch eror](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-eror/159086)
**Author:** [@rcbart](https://discuss.elastic.co/u/rcbart)\ **Replies:** 3\ **Last updated:** [December 3, 2018, 4:28pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-eror/159086 "2018-12-03T16:28:16Z")
I am getting the following error when parsing an apache log: \[2018-12-02T21:11:37,512\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index… --- ## [Is it possible to dynamically edit a logstash config file from command line on Windows PC?](https://discuss.elastic.co/t/is-it-possible-to-dynamically-edit-a-logstash-config-file-from-command-line-on-windows-pc/159218)
**Author:** [@Preeti\_Duraipandian](https://discuss.elastic.co/u/Preeti_Duraipandian)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 4:19pm UTC](https://discuss.elastic.co/t/is-it-possible-to-dynamically-edit-a-logstash-config-file-from-command-line-on-windows-pc/159218 "2018-12-03T16:19:46Z")
Hello, I want 6 or 7 config files which are largely similar except for a few changes in the fields including the statement. Is it possible to keep the files similar and give the changed variable values from the command l… --- ## [Parsing ASCII character 30](https://discuss.elastic.co/t/parsing-ascii-character-30/159207)
**Author:** [@tls](https://discuss.elastic.co/u/tls)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 3:35pm UTC](https://discuss.elastic.co/t/parsing-ascii-character-30/159207 "2018-12-03T15:35:50Z")
I have several dockers sending their logs to ELK. input { udp { port =\> 5000 type =\> docker } } filter { if \[type\] == "docker" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP… --- ## [Problems with Logstash Parsing](https://discuss.elastic.co/t/problems-with-logstash-parsing/159156)
**Author:** [@Omar\_Butt](https://discuss.elastic.co/u/Omar_Butt)\ **Replies:** 1\ **Last updated:** [December 3, 2018, 1:51pm UTC](https://discuss.elastic.co/t/problems-with-logstash-parsing/159156 "2018-12-03T13:51:17Z")
Hi Guys, My first post so please bear with me. I have the following config in Logstash: input { file { path =\> "/var/log/messages" start\_position =\> "beginning" } } filter { grok { match =\> { "message" =\> "%{CI… --- ## [Altering deleting control characters on tcp stream import](https://discuss.elastic.co/t/altering-deleting-control-characters-on-tcp-stream-import/159181)
**Author:** [@confused](https://discuss.elastic.co/u/confused)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 1:03pm UTC](https://discuss.elastic.co/t/altering-deleting-control-characters-on-tcp-stream-import/159181 "2018-12-03T13:03:44Z")
Hi I have a logstash.conf input to import data: // { tcp{ codec =\> "json" mode =\> "client" }} This is importing some data, but my data has a ctrl 03 character at the end of each line rather than newline. I have tri… --- ## [Logstash Email Config](https://discuss.elastic.co/t/logstash-email-config/157703)
**Author:** [@Nikhil\_Singh1](https://discuss.elastic.co/u/Nikhil_Singh1)\ **Replies:** 32\ **Last updated:** [December 3, 2018, 12:39pm UTC](https://discuss.elastic.co/t/logstash-email-config/157703 "2018-12-03T12:39:32Z")
This is my config file for logstash email plugin if "ERROR" in \[message\] { email { to =\> 'email' codec =\> "plain" from =\> 'email2' subject =\> 'Central logstash alert' via =\> 'smtp' body =\> 'Here is the event li… --- ## [Pipeline help -](https://discuss.elastic.co/t/pipeline-help/159165)
**Author:** [@Carlos\_Magalhaes](https://discuss.elastic.co/u/Carlos_Magalhaes)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 12:08pm UTC](https://discuss.elastic.co/t/pipeline-help/159165 "2018-12-03T12:08:01Z")
Hi all, Really need some help been trying to get this pipeline up and running but I just can't see what I am doing wrong. Thank you to @Christian\_Dahlqvist for pointing me to : the new feature in 6.5.1 which allows you … --- ## [The given configuration is invalid error](https://discuss.elastic.co/t/the-given-configuration-is-invalid-error/159160)
**Author:** [@Ruthvik\_Sai](https://discuss.elastic.co/u/Ruthvik_Sai)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 12:01pm UTC](https://discuss.elastic.co/t/the-given-configuration-is-invalid-error/159160 "2018-12-03T12:01:36Z")
Hi, The error I am getting is as follows: Sending Logstash logs to C:/logstash/logs which is now configured via log4j2.properties \[2018-12-03T17:04:03,950\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipel… --- ## [Running multiple logstash configuration files in a single docker run command](https://discuss.elastic.co/t/running-multiple-logstash-configuration-files-in-a-single-docker-run-command/159100)
**Author:** [@Senthil97](https://discuss.elastic.co/u/Senthil97)\ **Replies:** 1\ **Last updated:** [December 3, 2018, 11:55am UTC](https://discuss.elastic.co/t/running-multiple-logstash-configuration-files-in-a-single-docker-run-command/159100 "2018-12-03T11:55:37Z")
How to run multiple logstash.conf files for example (first-pipeline.conf and second-pipeline.conf) in a single logstash docker run command in linux environment(centos7) --- ## [Logstash Filter CSV - Multiple Header](https://discuss.elastic.co/t/logstash-filter-csv-multiple-header/159147)
**Author:** [@cmcdowell03](https://discuss.elastic.co/u/cmcdowell03)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 10:51am UTC](https://discuss.elastic.co/t/logstash-filter-csv-multiple-header/159147 "2018-12-03T10:51:02Z")
Hello, I am trying to parse a relatively complex .csv file with mulitple header lines. I am curious if there has been any headway on this issue or if there is a clever work around. I don't have an issue filtering the he… --- ## [Logstash can not read \*.log](https://discuss.elastic.co/t/logstash-can-not-read-log/159138)
**Author:** [@Chunbo\_Liao](https://discuss.elastic.co/u/Chunbo_Liao)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 10:13am UTC](https://discuss.elastic.co/t/logstash-can-not-read-log/159138 "2018-12-03T10:13:57Z")
could some one help to check this issue: when I run logstash to get data from \*.log file (I used nfs3 to map HDFS file to local file). the error logs like as bellow: \[2018-12-03T14:37:14,153\]\[ERROR\]\[filewatch.tailmode.… --- ## [How to use logstash to change the field type of winlogbeat data](https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898)
**Author:** [@godfather7](https://discuss.elastic.co/u/godfather7)\ **Replies:** 2\ **Last updated:** [December 3, 2018, 9:48am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898 "2018-12-03T09:48:20Z")
Hi, I want to change the field type from string to number of event\_data collected through winlogbeat. I have tried mutate way, but it's not working. Please tell me how to do it and how to reindex the data as well My c… --- ## [12factor way of logging to logstash](https://discuss.elastic.co/t/12factor-way-of-logging-to-logstash/159107)
**Author:** [@bkmagnetron](https://discuss.elastic.co/u/bkmagnetron)\ **Replies:** 2\ **Last updated:** [December 3, 2018, 9:47am UTC](https://discuss.elastic.co/t/12factor-way-of-logging-to-logstash/159107 "2018-12-03T09:47:54Z")
12factor says, A twelve-factor app never concerns itself with routing or storage of its output stream. It should not attempt to write to or manage logfiles. Instead, each running process writes its event stream, unbu… --- ## [Logstash doesn't parse logs after upgrading from 1.5.x to 6.5.x](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115)
**Author:** [@tbodhini](https://discuss.elastic.co/u/tbodhini)\ **Replies:** 2\ **Last updated:** [December 3, 2018, 9:45am UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115 "2018-12-03T09:45:40Z")
Hi all, my problem is the following: After upgrading "some" major versions, my logstash config doesn't work as expected anymore. I configured on several different containers and it should process the logs like before. O… --- ## [Logstash array](https://discuss.elastic.co/t/logstash-array/159122)
**Author:** [@dinesh1](https://discuss.elastic.co/u/dinesh1)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 9:00am UTC](https://discuss.elastic.co/t/logstash-array/159122 "2018-12-03T09:00:22Z")
How to add arrays or loops in the below filter.... filter { grok { match =\> { "source" =\> "/%{DATA:dir1}/%{DATA:dir2}/%{DATA:dir3}/%{DATA:mydata}/%{GREEDYDATA:end}" } } if \[mydata\] == "order"{ mutate { add\_field =\> … --- ## [Multiple pipelines accessing keystore -\> error](https://discuss.elastic.co/t/multiple-pipelines-accessing-keystore-error/158213)
**Author:** [@Mattias\_Arbin](https://discuss.elastic.co/u/Mattias_Arbin)\ **Replies:** 0\ **Last updated:** [November 26, 2018, 3:37pm UTC](https://discuss.elastic.co/t/multiple-pipelines-accessing-keystore-error/158213 "2018-11-26T15:37:22Z")
I am using the logstash keystore for passwords in my logstash configs, .e.g jdbc\_password =\> "${DB\_PWD}" I have 20 pipelines where all configs use the keystore like this. At startup I get random errors such as the one… --- ## [No events/s for logstash events with basic license](https://discuss.elastic.co/t/no-events-s-for-logstash-events-with-basic-license/159054)
**Author:** [@Sarfaraz\_Ahmad](https://discuss.elastic.co/u/Sarfaraz_Ahmad)\ **Replies:** 0\ **Last updated:** [December 2, 2018, 7:53pm UTC](https://discuss.elastic.co/t/no-events-s-for-logstash-events-with-basic-license/159054 "2018-12-02T19:53:29Z")
Hi, I just setup a very basic, minimal ELK cluster for learning purposes. I installed logstash/elasticsearch/kibana with basic xpack licenses where applicable. In Kibana's monitoring dashboard, I can see events per se… --- ## [How do i write my log stash logs in json format . I'm looking for any plugin like cerebro. Also need to know what is cerebro and the alternatives of it](https://discuss.elastic.co/t/how-do-i-write-my-log-stash-logs-in-json-format-im-looking-for-any-plugin-like-cerebro-also-need-to-know-what-is-cerebro-and-the-alternatives-of-it/159092)
**Author:** [@Poornisarathy](https://discuss.elastic.co/u/Poornisarathy)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 5:49am UTC](https://discuss.elastic.co/t/how-do-i-write-my-log-stash-logs-in-json-format-im-looking-for-any-plugin-like-cerebro-also-need-to-know-what-is-cerebro-and-the-alternatives-of-it/159092 "2018-12-03T05:49:45Z")
How do i write my log stash logs in json format . I'm looking for any plugin like cerebro. Also need to know what is cerebro and the alternatives of it. This is something like a plugin which we are looking for . Not the… --- ## [How to send multiple event logs in single email using logstash](https://discuss.elastic.co/t/how-to-send-multiple-event-logs-in-single-email-using-logstash/159089)
**Author:** [@naga\_kunchala](https://discuss.elastic.co/u/naga_kunchala)\ **Replies:** 1\ **Last updated:** [December 3, 2018, 5:42am UTC](https://discuss.elastic.co/t/how-to-send-multiple-event-logs-in-single-email-using-logstash/159089 "2018-12-03T05:42:25Z")
My requirement is send a multiple log events in a single mail through logstash email filter. is it possible or not? --- ## [Logstash Arcsight Integration](https://discuss.elastic.co/t/logstash-arcsight-integration/158998)
**Author:** [@sandeepnandula](https://discuss.elastic.co/u/sandeepnandula)\ **Replies:** 2\ **Last updated:** [December 3, 2018, 5:27am UTC](https://discuss.elastic.co/t/logstash-arcsight-integration/158998 "2018-12-03T05:27:31Z")
Hello, While Integrating logstash with arcsight we are facing an issue i.e " index is creating in kibana but there are no dashboards and also there is no index is being created in elasticsearch. Kibana shows "No matchin… --- ## [Logstash on Docker for AWS ECS](https://discuss.elastic.co/t/logstash-on-docker-for-aws-ecs/158719)
**Author:** [@patrick007](https://discuss.elastic.co/u/patrick007)\ **Replies:** 2\ **Last updated:** [December 3, 2018, 3:21am UTC](https://discuss.elastic.co/t/logstash-on-docker-for-aws-ecs/158719 "2018-12-03T03:21:08Z")
I want to create a docker image of Logstash make configuration changes in the container I am not able to find how can I set pipeline and config file for Logstash --- ## [How to run Logstash on Docker-compose](https://discuss.elastic.co/t/how-to-run-logstash-on-docker-compose/158867)
**Author:** [@patrick007](https://discuss.elastic.co/u/patrick007)\ **Replies:** 3\ **Last updated:** [December 3, 2018, 2:06am UTC](https://discuss.elastic.co/t/how-to-run-logstash-on-docker-compose/158867 "2018-12-03T02:06:14Z")
Logstash on Docker-compose ? How can we setup the config file --- ## [It usually means the last handler in the pipeline did not handle the exception](https://discuss.elastic.co/t/it-usually-means-the-last-handler-in-the-pipeline-did-not-handle-the-exception/159073)
**Author:** [@aabababba](https://discuss.elastic.co/u/aabababba)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 1:38am UTC](https://discuss.elastic.co/t/it-usually-means-the-last-handler-in-the-pipeline-did-not-handle-the-exception/159073 "2018-12-03T01:38:02Z")
\[WARN \]\[io.netty.channel.DefaultChannelPipeline\] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. io.netty… --- ## [Pipeline-to-Pipeline in 6.2.4](https://discuss.elastic.co/t/pipeline-to-pipeline-in-6-2-4/159057)
**Author:** [@tarmendeos](https://discuss.elastic.co/u/tarmendeos)\ **Replies:** 0\ **Last updated:** [December 2, 2018, 8:55pm UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-in-6-2-4/159057 "2018-12-02T20:55:31Z")
Hello! I'm relatively new to the ELK stack, and I've got a problem where I am in need of the output-isolator pattern described in https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html, but the featur… --- ## [Issue with Logstash installation on Windows](https://discuss.elastic.co/t/issue-with-logstash-installation-on-windows/159008)
**Author:** [@ericmartinez90](https://discuss.elastic.co/u/ericmartinez90)\ **Replies:** 1\ **Last updated:** [December 1, 2018, 6:06pm UTC](https://discuss.elastic.co/t/issue-with-logstash-installation-on-windows/159008 "2018-12-01T18:06:14Z")
Hello everyone, I am entirely new to Elasticsearch, Logstash, and Kibana (ELK). I am currently taking a Udemy course to learn the ELK stack, but the instructor is covering the course material on a Mac platform, and I ha… --- ## [Parsing issues of JSON within a syslog event](https://discuss.elastic.co/t/parsing-issues-of-json-within-a-syslog-event/158999)
**Author:** [@jorj](https://discuss.elastic.co/u/jorj)\ **Replies:** 0\ **Last updated:** [December 1, 2018, 11:58am UTC](https://discuss.elastic.co/t/parsing-issues-of-json-within-a-syslog-event/158999 "2018-12-01T11:58:05Z")
I have a list of Syslog events in a file, that starts as Syslog message but the remaining in JSON format, and i'm unable to find a way to parse it properly. Syslog Messages format (some logs has 1 type of events, other … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=638) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=640)