# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=642 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 643 --- ## [Slaesforce Plugin Issue](https://discuss.elastic.co/t/slaesforce-plugin-issue/158390)
**Author:** [@ashishlal](https://discuss.elastic.co/u/ashishlal)\ **Replies:** 1\ **Last updated:** [November 27, 2018, 6:43pm UTC](https://discuss.elastic.co/t/slaesforce-plugin-issue/158390 "2018-11-27T18:43:06Z")
I am trying to run logstash plugin and receive no error when I run the input config input { salesforce { client\_id =\> 'OAUTH CLIENT ID FROM YOUR SFDC APP' client\_secret =\> 'OAUTH CLIENT SECRET FROM YOUR SFDC APP' us… --- ## [Logstash JDBC Plugin: IllegalArgumentException "HOUR\_OF\_DAY: 2 -\> 3"](https://discuss.elastic.co/t/logstash-jdbc-plugin-illegalargumentexception-hour-of-day-2-3/158395)
**Author:** [@jscubida](https://discuss.elastic.co/u/jscubida)\ **Replies:** 0\ **Last updated:** [November 27, 2018, 6:07pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-illegalargumentexception-hour-of-day-2-3/158395 "2018-11-27T18:07:27Z")
Hello. I am trying to import a MySQL table into Elasticsearch using Logstash (version 5.6.4). I get the following error: \[2018-11-27T12:48:46,216\]\[WARN \]\[logstash.inputs.jdbc \] Exception when executing JDBC query {:… --- ## [Trying to parse xml with \\r in the xml message field](https://discuss.elastic.co/t/trying-to-parse-xml-with-r-in-the-xml-message-field/156406)
**Author:** [@lukas.bayard](https://discuss.elastic.co/u/lukas.bayard)\ **Replies:** 9\ **Last updated:** [November 27, 2018, 4:47pm UTC](https://discuss.elastic.co/t/trying-to-parse-xml-with-r-in-the-xml-message-field/156406 "2018-11-27T16:47:44Z")
I try to read an XML file with Logstash. But the XML is only read until the first \\r. Shouldn't everything be read with Multiline? Or how can I exclude that message field? XML File\ **Author:** [@rueldu](https://discuss.elastic.co/u/rueldu)\ **Replies:** 3\ **Last updated:** [November 27, 2018, 3:46pm UTC](https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214 "2018-11-27T15:46:18Z") Hello everyone, I have installed ELK, one server ELASTICSEARCH, 3 servers (collectors) that have installed LOGSTASH and ELASTIFLOW and each one is in 3 branches. In a branch there is a server where logstash is installed… --- ## [Problem to activate x-pack on Logstash](https://discuss.elastic.co/t/problem-to-activate-x-pack-on-logstash/157575)
**Author:** [@Alexandre\_Bunn](https://discuss.elastic.co/u/Alexandre_Bunn)\ **Replies:** 2\ **Last updated:** [November 27, 2018, 3:15pm UTC](https://discuss.elastic.co/t/problem-to-activate-x-pack-on-logstash/157575 "2018-11-27T15:15:07Z")
Good afternoon I have a logstash, version 5.6.8, instance running OK, after I've installed the x-pack and add the configurations line below, the daemon doesn't start and log the error below: \[2018-11-20T14:53:03,092\]\[E… --- ## [Indexing data in elasticsearch through logstash using xml files](https://discuss.elastic.co/t/indexing-data-in-elasticsearch-through-logstash-using-xml-files/158242)
**Author:** [@Andrey\_Querejeta](https://discuss.elastic.co/u/Andrey_Querejeta)\ **Replies:** 4\ **Last updated:** [November 27, 2018, 2:07pm UTC](https://discuss.elastic.co/t/indexing-data-in-elasticsearch-through-logstash-using-xml-files/158242 "2018-11-27T14:07:17Z")
Hello, everybody: I am new using ELK, although I have managed to index data into elasticsearch through logstash, using the CSV filter. For several days I have tried to use the XML filter without results. I have read se… --- ## [Logstash doesn't parse date](https://discuss.elastic.co/t/logstash-doesnt-parse-date/157983)
**Author:** [@okovalevsky](https://discuss.elastic.co/u/okovalevsky)\ **Replies:** 2\ **Last updated:** [November 27, 2018, 12:56pm UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-date/157983 "2018-11-27T12:56:15Z")
Hello! I created config in previous version of logstash and it was working good. After logstash update (removed and install new version) i used settings from my config, but it doesn't parse date. Example xml is for se… --- ## [How to extract message from nested json](https://discuss.elastic.co/t/how-to-extract-message-from-nested-json/158336)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [November 27, 2018, 12:38pm UTC](https://discuss.elastic.co/t/how-to-extract-message-from-nested-json/158336 "2018-11-27T12:38:10Z")
this is below json format as input I am getting overall message in the nested format { "\_type": "json", "\_id": "AWdVED5hASX98xJL-Xkw", "\_score": 1, "\_source": { "value1": "rajesh", "@version": "1", "host": "DES… --- ## [Conditional updating of existing record](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309)
**Author:** [@Evelina\_V](https://discuss.elastic.co/u/Evelina_V)\ **Replies:** 4\ **Last updated:** [November 27, 2018, 12:08pm UTC](https://discuss.elastic.co/t/conditional-updating-of-existing-record/158309 "2018-11-27T12:08:50Z")
Hi, I am very new to elastic and would like to get an advice. I have messages looking something like that: THREAD\_ID:101 MSG\_TYPE:1 FINAL\_STATE:EXPIRED THREAD\_ID:101 MSG\_TYPE:2 FINAL\_STATE:DELIVERED They arrive in … --- ## [TCP input plugin](https://discuss.elastic.co/t/tcp-input-plugin/158016)
**Author:** [@pradeepthota07](https://discuss.elastic.co/u/pradeepthota07)\ **Replies:** 2\ **Last updated:** [November 23, 2018, 3:44pm UTC](https://discuss.elastic.co/t/tcp-input-plugin/158016 "2018-11-23T15:44:35Z")
Here is my config for input tcp: input { tcp { port =\> 9400 type =\> "log-tcp" add\_field =\> {"parser" =\> "LOGSTASH"} ssl\_enable =\> true ssl\_cert =\> "/epwf1/ci/logstash/logstash-6.5.1/certs/cert.pem" ssl\_key =\> "/e… --- ## [GROK debugger the parsing works but not in logstash](https://discuss.elastic.co/t/grok-debugger-the-parsing-works-but-not-in-logstash/158301)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [November 27, 2018, 10:39am UTC](https://discuss.elastic.co/t/grok-debugger-the-parsing-works-but-not-in-logstash/158301 "2018-11-27T10:39:29Z")
GROK filter ^%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}|%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}|%{SPACE}%{GREEDYDATA:service}%{SPACE}%{SPACE}|%{SPACE}%{WORD:class}%{SPACE}|%{SPACE}%{NUMBER:statuscode}%{SPACE}-%{SPACE}%{GREEDYD… --- ## [No matching index found for arcsight-\*](https://discuss.elastic.co/t/no-matching-index-found-for-arcsight/158280)
**Author:** [@jagan](https://discuss.elastic.co/u/jagan)\ **Replies:** 13\ **Last updated:** [November 27, 2018, 10:22am UTC](https://discuss.elastic.co/t/no-matching-index-found-for-arcsight/158280 "2018-11-27T10:22:00Z")
HI mates, i started arcsight module to pull the data and found the index created in kibana with dashboards but none of the dashboards are accessible.When try to open the dashboard i got the error as: no matching index f… --- ## [LogStash ConfigurationError](https://discuss.elastic.co/t/logstash-configurationerror/156004)
**Author:** [@aruntracer](https://discuss.elastic.co/u/aruntracer)\ **Replies:** 7\ **Last updated:** [November 27, 2018, 10:19am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004 "2018-11-27T10:19:39Z")
Log.conf 1524206424.034 19395 207.96.0.0 TCP\_MISS/304 15363 GET http://elastic.co/android-chrome-192x192.gif - DIRECT/10.0.5.120 - 1524206424.145 106 207.96.0.0 TCP\_HIT/200 68247 GET http://elastic.co/guide/en/log… --- ## [Conditional forwarding in logstash.conf not working](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192)
**Author:** [@Gegi\_K](https://discuss.elastic.co/u/Gegi_K)\ **Replies:** 7\ **Last updated:** [November 27, 2018, 8:44am UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192 "2018-11-27T08:44:09Z")
Hi People, I try to get some conditional splitting in logstash conf working, and missing something maybe... I use this config: input { tcp { port =\> 5001 type =\> syslog } udp { port =\> 5001 type =\> syslog } … --- ## [Can someone help with the problem? logstasherror](https://discuss.elastic.co/t/can-someone-help-with-the-problem-logstasherror/158272)
**Author:** [@6eaa863718a20dea686f](https://discuss.elastic.co/u/6eaa863718a20dea686f)\ **Replies:** 1\ **Last updated:** [November 27, 2018, 8:10am UTC](https://discuss.elastic.co/t/can-someone-help-with-the-problem-logstasherror/158272 "2018-11-27T08:10:21Z")
\[2018-11-27T13:52:07,975\]\[INFO \]\[logstash.agent \] Successfully started Logstash API endpoint {:port=\>9600} \[2018-11-27T13:52:27,813\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.version"=\>"6.… --- ## [Problem with with date parse](https://discuss.elastic.co/t/problem-with-with-date-parse/158267)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 1\ **Last updated:** [November 27, 2018, 8:09am UTC](https://discuss.elastic.co/t/problem-with-with-date-parse/158267 "2018-11-27T08:09:31Z")
HI Team, I am finding it difficult to parse the date in my log, Example: 2018-Nov-28 10:25:33.086 tried parsing with "YYYY-MMMM-dd hh:mm:ss", "ISO8601", "yyyy-MM-dd HH:mm:ss,SSS", "dd-MMM-yyyy HH:mm:ss,SSS" --- ## [Logstash-input-beats and logstash-input-http : log4j-api need upgraded \>= 2.8.2 as vulnerability CVE-2017-5645](https://discuss.elastic.co/t/logstash-input-beats-and-logstash-input-http-log4j-api-need-upgraded-2-8-2-as-vulnerability-cve-2017-5645/158284)
**Author:** [@caixiangibm](https://discuss.elastic.co/u/caixiangibm)\ **Replies:** 0\ **Last updated:** [November 27, 2018, 7:32am UTC](https://discuss.elastic.co/t/logstash-input-beats-and-logstash-input-http-log4j-api-need-upgraded-2-8-2-as-vulnerability-cve-2017-5645/158284 "2018-11-27T07:32:53Z")
With upgrade logstash to v6.5, the plugin logstash-input-beats to 5.1.6 and logstash-input-http to 3.2.2, but the dependency of log4j-api still at version of "2.6.2", which is addressed in vulnerability CVE-2017-5645, an… --- ## [Don't know why \_grokparsefailure](https://discuss.elastic.co/t/dont-know-why-grokparsefailure/158217)
**Author:** [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)\ **Replies:** 1\ **Last updated:** [November 27, 2018, 5:21am UTC](https://discuss.elastic.co/t/dont-know-why-grokparsefailure/158217 "2018-11-27T05:21:19Z")
Hello, I'm trying to parse this log format: alarms\_2gw:ddb\_alr:Warn.GenProc-No:1306,Id:10462,TimeScada:26/11/1816:15:22,TimeSource:1543248887.0,Kidx:565141,state:1.000000,type:5,Hl0:LOCAL,Stat=0200H,AlrTyp=c2H,attr=10H … --- ## [Elasicsearch is not creating an index even there are no errors](https://discuss.elastic.co/t/elasicsearch-is-not-creating-an-index-even-there-are-no-errors/158180)
**Author:** [@frasmd](https://discuss.elastic.co/u/frasmd)\ **Replies:** 12\ **Last updated:** [November 26, 2018, 9:14pm UTC](https://discuss.elastic.co/t/elasicsearch-is-not-creating-an-index-even-there-are-no-errors/158180 "2018-11-26T21:14:52Z")
I have installed Elasticstash 6.2.4 with one filebeat node and a node with elasticsearch, kibana and logstash on the same node. Now i am trying to send logs of the a server using filebeat to logstash using the below conf… --- ## [Xml filter with keyvalue pair](https://discuss.elastic.co/t/xml-filter-with-keyvalue-pair/157613)
**Author:** [@perryparktung](https://discuss.elastic.co/u/perryparktung)\ **Replies:** 4\ **Last updated:** [November 26, 2018, 4:50pm UTC](https://discuss.elastic.co/t/xml-filter-with-keyvalue-pair/157613 "2018-11-26T16:50:55Z")
Hi, I have an xml input like this, which has a keyValue, containing , and . The multiple in caused logstash to have data type mismatch. Is there a way in the xml filter to map as the field name and as the value o… --- ## [Logstash Salesforce Plugin embed REST API to monitor logs](https://discuss.elastic.co/t/logstash-salesforce-plugin-embed-rest-api-to-monitor-logs/158223)
**Author:** [@ashishlal](https://discuss.elastic.co/u/ashishlal)\ **Replies:** 0\ **Last updated:** [November 26, 2018, 4:45pm UTC](https://discuss.elastic.co/t/logstash-salesforce-plugin-embed-rest-api-to-monitor-logs/158223 "2018-11-26T16:45:33Z")
Hello, I am new to ELK and I am trying to ingest Salesforce logs into ELK stack. I am using Salesforce plugin available online. I was wondering if I can insert a REST API to query and monitor a Salesforce sobject. I am … --- ## [Logstash config for splitting array into new events](https://discuss.elastic.co/t/logstash-config-for-splitting-array-into-new-events/158184)
**Author:** [@00a45f9a00ca005db54c](https://discuss.elastic.co/u/00a45f9a00ca005db54c)\ **Replies:** 1\ **Last updated:** [November 26, 2018, 3:39pm UTC](https://discuss.elastic.co/t/logstash-config-for-splitting-array-into-new-events/158184 "2018-11-26T15:39:15Z")
Hi there. I'm trying to split array into separate log files. Input is a JSON like this { "data": \[ { "field1": "val1", "field2": "val2" }, { "field1": "val1", "field2": "val2" }… --- ## ["Something is wrong with your Configuration Error" in logstash](https://discuss.elastic.co/t/something-is-wrong-with-your-configuration-error-in-logstash/158197)
**Author:** [@Sanj](https://discuss.elastic.co/u/Sanj)\ **Replies:** 2\ **Last updated:** [November 26, 2018, 3:37pm UTC](https://discuss.elastic.co/t/something-is-wrong-with-your-configuration-error-in-logstash/158197 "2018-11-26T15:37:56Z")
Hi Team, I'm trying to run a simple logstash configuration that is mentioned below input { beats { port =\> 5044 } } filter { kv { source =\> "message" trim =\> "{}" field\_split =\> "," value\_split =\> ":" } } output… --- ## [GeoIP lat,lon fields are numbers instead of float](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132)
**Author:** [@prakas](https://discuss.elastic.co/u/prakas)\ **Replies:** 19\ **Last updated:** [November 26, 2018, 1:43pm UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132 "2018-11-26T13:43:53Z")
Hello Team, I see that the geoip.latitude, geoip.longitude are numbers and does not take decimal values, so a wrong position is plotted on the Tile Map. For example an ip of 14.143.35.10 results in lat:20, lon:77 where… --- ## [How logstash parse sqlite data to json file](https://discuss.elastic.co/t/how-logstash-parse-sqlite-data-to-json-file/158162)
**Author:** [@T\_Putra\_Safrul\_Huda](https://discuss.elastic.co/u/T_Putra_Safrul_Huda)\ **Replies:** 6\ **Last updated:** [November 26, 2018, 1:35pm UTC](https://discuss.elastic.co/t/how-logstash-parse-sqlite-data-to-json-file/158162 "2018-11-26T13:35:41Z")
my purpose is using elasticsearch for sqlite data analysis and i am use logstash for parse sqlite to json format, i not understand how setting that, can you help me --- ## [JSON Parsing failure on logstash](https://discuss.elastic.co/t/json-parsing-failure-on-logstash/158156)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 6\ **Last updated:** [November 26, 2018, 1:03pm UTC](https://discuss.elastic.co/t/json-parsing-failure-on-logstash/158156 "2018-11-26T13:03:21Z")
HI, I have json when i try to index those logs into elasticsearch. When i apply json filter some logs are omitted to get index on ES. when i command those json filter i can index those event into ES. i have validated th… --- ## [How to convert time typestring into date type](https://discuss.elastic.co/t/how-to-convert-time-typestring-into-date-type/157714)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 14\ **Last updated:** [November 26, 2018, 1:01pm UTC](https://discuss.elastic.co/t/how-to-convert-time-typestring-into-date-type/157714 "2018-11-26T13:01:26Z")
HI, I want to convert on string time field into date type. My log is json format and its getting index into this field, bridgeNemoJenkinsData.time taken.keyword string I have implemented date filter to convert this a… --- ## [Logstash instance](https://discuss.elastic.co/t/logstash-instance/158172)
**Author:** [@Sripal](https://discuss.elastic.co/u/Sripal)\ **Replies:** 6\ **Last updated:** [November 26, 2018, 12:35pm UTC](https://discuss.elastic.co/t/logstash-instance/158172 "2018-11-26T12:35:34Z")
Hi, I have some doubt in logstash instance. I ran one config file "logstash -f abc.conf" my path.data is "logstash/data" I tried to ran another config "logstash -f xyz.conf" it is showing error as "Logstash could not… --- ## [Time Field issue](https://discuss.elastic.co/t/time-field-issue/158119)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 24\ **Last updated:** [November 26, 2018, 11:43am UTC](https://discuss.elastic.co/t/time-field-issue/158119 "2018-11-26T11:43:20Z")
Hello Team, I have write down a pattern for my log and its parsing properly from it. Below is the sample log: I, \[2018-11-26T06:30:02.281210 #17562\] INFO -- : \[0b94e730-7bf1-435d-9f4b-8dd17a0769c1\] Current device: 176… --- ## [Error with ruby filter plugin](https://discuss.elastic.co/t/error-with-ruby-filter-plugin/158081)
**Author:** [@ou\_snaaksie](https://discuss.elastic.co/u/ou_snaaksie)\ **Replies:** 1\ **Last updated:** [November 26, 2018, 11:08am UTC](https://discuss.elastic.co/t/error-with-ruby-filter-plugin/158081 "2018-11-26T11:08:58Z")
I am receiving errors I can't solve, since my config seems correct to me. It is complaining about the use of the ruby filter plugin, but the ruby code is valid. input { beats { port =\> 5443 } } filter { ruby … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=641) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=643)