# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=643 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 644 --- ## [Logstash Schedule every minute from 8 AM to 12 PM and from 2 PM to 6PM](https://discuss.elastic.co/t/logstash-schedule-every-minute-from-8-am-to-12-pm-and-from-2-pm-to-6pm/158032)
**Author:** [@ali1](https://discuss.elastic.co/u/ali1)\ **Replies:** 7\ **Last updated:** [November 26, 2018, 9:47am UTC](https://discuss.elastic.co/t/logstash-schedule-every-minute-from-8-am-to-12-pm-and-from-2-pm-to-6pm/158032 "2018-11-26T09:47:47Z")
Hello, im working with logstash that get data from oracle database every minute and it works fine, but for some performance issue i have to configure logstash to execute every minute from 8 AM to 12 PM and from 2 PM to… --- ## [How to Install multiple logstash on different computer?](https://discuss.elastic.co/t/how-to-install-multiple-logstash-on-different-computer/157832)
**Author:** [@aabababba](https://discuss.elastic.co/u/aabababba)\ **Replies:** 14\ **Last updated:** [November 26, 2018, 9:42am UTC](https://discuss.elastic.co/t/how-to-install-multiple-logstash-on-different-computer/157832 "2018-11-26T09:42:32Z")
all the filebeat client out put to multiple logstash,then all the logstash out put to one elasticsearch? --- ## [How to index different time formats into one field？](https://discuss.elastic.co/t/how-to-index-different-time-formats-into-one-field/158139)
**Author:** [@aabababba](https://discuss.elastic.co/u/aabababba)\ **Replies:** 0\ **Last updated:** [November 26, 2018, 8:59am UTC](https://discuss.elastic.co/t/how-to-index-different-time-formats-into-one-field/158139 "2018-11-26T08:59:47Z")
\[2018-11-26 16:40:00.196\] 16:16:00,022 Nov 20 09:26:36 like that can index to one field "logtime"? --- ## [Logstash not creating indexes for csv file input](https://discuss.elastic.co/t/logstash-not-creating-indexes-for-csv-file-input/157820)
**Author:** [@emile1](https://discuss.elastic.co/u/emile1)\ **Replies:** 3\ **Last updated:** [November 26, 2018, 7:51am UTC](https://discuss.elastic.co/t/logstash-not-creating-indexes-for-csv-file-input/157820 "2018-11-26T07:51:55Z")
Hi All I'm at a loss I'm trying to process a csv file via logstash. My Config below is not creating any indexes in ES. Looking at the logstash logs it does not look like their is an error in my config. Im adding my conf… --- ## [Sizing logstash servers](https://discuss.elastic.co/t/sizing-logstash-servers/158115)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [November 26, 2018, 7:48am UTC](https://discuss.elastic.co/t/sizing-logstash-servers/158115 "2018-11-26T07:48:01Z")
Would like to know the number of logstash nodes to process 8 billion log events/day, 5TB of total size/day and having average size of log event around 1KB. --- ## [Encrypting and authenticating communication between Winlogbeat and Logstash](https://discuss.elastic.co/t/encrypting-and-authenticating-communication-between-winlogbeat-and-logstash/158108)
**Author:** [@popa](https://discuss.elastic.co/u/popa)\ **Replies:** 2\ **Last updated:** [November 26, 2018, 4:18am UTC](https://discuss.elastic.co/t/encrypting-and-authenticating-communication-between-winlogbeat-and-logstash/158108 "2018-11-26T04:18:56Z")
I've working on a proof of concept where I'm using Elasticsearch, Logstash, Kibana and Winlogbeat. The Winlogbeat service is running on a remote system and then sending events directly to Logstash. I've setup my configu… --- ## [Is beats information lost while sending logs from Beats --\> Logstash --\> Kafka --\> Logstash --\> Elasticsearch](https://discuss.elastic.co/t/is-beats-information-lost-while-sending-logs-from-beats-logstash-kafka-logstash-elasticsearch/158110)
**Author:** [@mahesh\_s](https://discuss.elastic.co/u/mahesh_s)\ **Replies:** 0\ **Last updated:** [November 26, 2018, 2:02am UTC](https://discuss.elastic.co/t/is-beats-information-lost-while-sending-logs-from-beats-logstash-kafka-logstash-elasticsearch/158110 "2018-11-26T02:02:51Z")
Hi, I have implemented logstash as below: Beats --\> Logstash --\> Kafka --\> Logstash --\> Elasticsearch+Kibana However, While sending data directly from Beats --\> Logstash --\> Elasticsearch, I can see all fields related… --- ## [Any functions to put sequence number on file names?](https://discuss.elastic.co/t/any-functions-to-put-sequence-number-on-file-names/156997)
**Author:** [@sho](https://discuss.elastic.co/u/sho)\ **Replies:** 9\ **Last updated:** [November 26, 2018, 12:35am UTC](https://discuss.elastic.co/t/any-functions-to-put-sequence-number-on-file-names/156997 "2018-11-26T00:35:02Z")
I'm looking for the function for putting sequence number on output file name. (I'm not sure that Logstash has this function though.. let me know if it doesn't exist..) Thanks & Regards, Sho --- ## [Persistent values between events from the same filebeat source file](https://discuss.elastic.co/t/persistent-values-between-events-from-the-same-filebeat-source-file/158096)
**Author:** [@ou\_snaaksie](https://discuss.elastic.co/u/ou_snaaksie)\ **Replies:** 0\ **Last updated:** [November 25, 2018, 3:26pm UTC](https://discuss.elastic.co/t/persistent-values-between-events-from-the-same-filebeat-source-file/158096 "2018-11-25T15:26:26Z")
I need some help with an issue I am having. It is not necessarily a Logstash issue, but rather an issue with the processing logic. I am using Filebeat to send the logs to Logstash for further processing. The log lines ar… --- ## [Need help with logstash conf file - spilitting log message](https://discuss.elastic.co/t/need-help-with-logstash-conf-file-spilitting-log-message/158078)
**Author:** [@Palino1611](https://discuss.elastic.co/u/Palino1611)\ **Replies:** 2\ **Last updated:** [November 24, 2018, 11:30pm UTC](https://discuss.elastic.co/t/need-help-with-logstash-conf-file-spilitting-log-message/158078 "2018-11-24T23:30:55Z")
Hello guys, please could you help me to create logstash conf.d file for splitting following message? 1.234.85.29 \<1.234.85.29\> - - \[24/Nov/2018:20:54:11 +0000\] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 444 0 "-" "Mo… --- ## [Facing error](https://discuss.elastic.co/t/facing-error/158067)
**Author:** [@yogesh\_kumar](https://discuss.elastic.co/u/yogesh_kumar)\ **Replies:** 0\ **Last updated:** [November 24, 2018, 12:39pm UTC](https://discuss.elastic.co/t/facing-error/158067 "2018-11-24T12:39:34Z")
File content: input { file { path =\> "/app/pentaho/pentaho/pdi-ee/data-integration-server/tomcat/logs/localhost-access.2018-11-23.log" type =\> "tomcat\_access" } The filter part of this file is commented out to indi… --- ## [VMware Syslog Grok Patterns](https://discuss.elastic.co/t/vmware-syslog-grok-patterns/157868)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 2\ **Last updated:** [November 23, 2018, 5:35pm UTC](https://discuss.elastic.co/t/vmware-syslog-grok-patterns/157868 "2018-11-23T17:35:28Z")
Hi all, I want to collect VMware Syslogs into my ELK. Like expected, the VMware syslog format is not RFC conform and so I got an "\_grokparsefailure\_sysloginput", when using input syslog. So I will change to input udp, … --- ## [Not able to execute http request in Filter with JSON Payload](https://discuss.elastic.co/t/not-able-to-execute-http-request-in-filter-with-json-payload/157822)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 13\ **Last updated:** [November 23, 2018, 3:36pm UTC](https://discuss.elastic.co/t/not-able-to-execute-http-request-in-filter-with-json-payload/157822 "2018-11-23T15:36:33Z")
Hi Not able to execute http request in Filter with JSON Payload Here how my conf file looks like rest { request =\> { url =\>"https://abc.com" method =\> "post" headers =\> { "A… --- ## [How to store variable length JSON into fields?](https://discuss.elastic.co/t/how-to-store-variable-length-json-into-fields/157511)
**Author:** [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Replies:** 1\ **Last updated:** [November 23, 2018, 3:03pm UTC](https://discuss.elastic.co/t/how-to-store-variable-length-json-into-fields/157511 "2018-11-23T15:03:42Z")
Hi there, I've ran into similar issues where this kind of solution would be handy to know, but I don't know if its possible! I have several different storage systems I am trying to monitor using their built-in API. So … --- ## [NameError: uninitialized constant Concurrent::ImmediateExecutor](https://discuss.elastic.co/t/nameerror-uninitialized-constant-concurrent-immediateexecutor/158027)
**Author:** [@elkha](https://discuss.elastic.co/u/elkha)\ **Replies:** 0\ **Last updated:** [November 23, 2018, 2:48pm UTC](https://discuss.elastic.co/t/nameerror-uninitialized-constant-concurrent-immediateexecutor/158027 "2018-11-23T14:48:33Z")
I dont able to start and parse log file . I had an error when doing the command line : logstash.bat -f conffile.conf NameError: uninitialized constant Concurrent::ImmediateExecutor const\_missing at org/jruby/RubyModu… --- ## [S3 input stack trace and multi-pipeline config question](https://discuss.elastic.co/t/s3-input-stack-trace-and-multi-pipeline-config-question/158022)
**Author:** [@shed7](https://discuss.elastic.co/u/shed7)\ **Replies:** 0\ **Last updated:** [November 23, 2018, 2:08pm UTC](https://discuss.elastic.co/t/s3-input-stack-trace-and-multi-pipeline-config-question/158022 "2018-11-23T14:08:19Z")
Hello Had a stack trace appear when using the following configs, there are a few more configs I couldn't fit in this post, but are very similar to the one below. I found including more than 1 config in a single pipeline… --- ## [Logstash filter not working](https://discuss.elastic.co/t/logstash-filter-not-working/157984)
**Author:** [@DanielE](https://discuss.elastic.co/u/DanielE)\ **Replies:** 2\ **Last updated:** [November 23, 2018, 2:09pm UTC](https://discuss.elastic.co/t/logstash-filter-not-working/157984 "2018-11-23T14:09:44Z")
Hi gals, i am using the following filter: filter { if \[type\] == "syslog" { if \[host\] == "X.X.X.X" { grok { match =\> { "message" =\> "\<%{POSINT:syslog\_pri}\>%{SYSLOGTIMESTAMP:syslog\_timestamp} %… --- ## [Grok Parsing Troubles](https://discuss.elastic.co/t/grok-parsing-troubles/158020)
**Author:** [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)\ **Replies:** 1\ **Last updated:** [November 23, 2018, 2:00pm UTC](https://discuss.elastic.co/t/grok-parsing-troubles/158020 "2018-11-23T14:00:25Z")
Hello guys. Need some help parsing this log: TNS-12518: TNS:listener could not hand off client connection TNS-12547: TNS:lost contact TNS-12560: TNS:protocol adapter error TNS-00517: Lost contact Linux Error: … --- ## [Can't input in logstash for multiline](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003)
**Author:** [@Denis\_Neres](https://discuss.elastic.co/u/Denis_Neres)\ **Replies:** 5\ **Last updated:** [November 23, 2018, 1:29pm UTC](https://discuss.elastic.co/t/cant-input-in-logstash-for-multiline/158003 "2018-11-23T13:29:32Z")
Hello guys, so I have a specific pattern of logs that loogs like this: \[2018-11-17 11:10:26.267\] \[s-ss-ares\] \[http-apr-8080-exec-1\] ERROR b.c.s.g.p.s.s.DashboardServiceImpl@logException:41 - \[testesemp\] - \[Supervisor 00… --- ## [Logstash connection to Elastic Cloud](https://discuss.elastic.co/t/logstash-connection-to-elastic-cloud/158007)
**Author:** [@R4v3n](https://discuss.elastic.co/u/R4v3n)\ **Replies:** 2\ **Last updated:** [November 23, 2018, 1:18pm UTC](https://discuss.elastic.co/t/logstash-connection-to-elastic-cloud/158007 "2018-11-23T13:18:11Z")
Dear elastic-friends, Sorry if I don't post in the good place but I cant find any solution to my misconfiguration. I have a CentOS hosted in the cloud and gather logs from various party I would like to use Logstash to… --- ## [Design and implementation dimensions on pipelines and indices](https://discuss.elastic.co/t/design-and-implementation-dimensions-on-pipelines-and-indices/157986)
**Author:** [@acropia](https://discuss.elastic.co/u/acropia)\ **Replies:** 3\ **Last updated:** [November 23, 2018, 12:58pm UTC](https://discuss.elastic.co/t/design-and-implementation-dimensions-on-pipelines-and-indices/157986 "2018-11-23T12:58:31Z")
I'm fairly new to Elastic Stack and try to setup a lab environment for Proof-of-Concept. I've watched almost every Getting Start video on de Elastic website and read documentation thorougly on installing my setup. So I k… --- ## [Special characters in field names? (äöü, ...)](https://discuss.elastic.co/t/special-characters-in-field-names-aou/158004)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [November 23, 2018, 12:17pm UTC](https://discuss.elastic.co/t/special-characters-in-field-names-aou/158004 "2018-11-23T12:17:53Z")
Hi, is it possible to use special characters like German chars äöüÄÜÜß in field names? Logstash 6.5.1 is throwing: detected ambiguous Field Reference \`\[Blob\]\[Datei\]\[L\`, which we expanded to the path \`\[Blob, Datei, L\]\`… --- ## [Logstash un-gzip array log configuration](https://discuss.elastic.co/t/logstash-un-gzip-array-log-configuration/158000)
**Author:** [@00a45f9a00ca005db54c](https://discuss.elastic.co/u/00a45f9a00ca005db54c)\ **Replies:** 2\ **Last updated:** [November 23, 2018, 12:12pm UTC](https://discuss.elastic.co/t/logstash-un-gzip-array-log-configuration/158000 "2018-11-23T12:12:58Z")
Hey everyone! I have logstash config, which forwards logs from RabbitMQ to elasticSearch. Something like this: input { rabbitmq { ... } } filter { if \[type\] == "rabbitmq" { json { … --- ## [Logstash does not created proper timestamp from field](https://discuss.elastic.co/t/logstash-does-not-created-proper-timestamp-from-field/157955)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 22\ **Last updated:** [November 23, 2018, 11:49am UTC](https://discuss.elastic.co/t/logstash-does-not-created-proper-timestamp-from-field/157955 "2018-11-23T11:49:46Z")
Hello I have a rule where I am trying to convert the timestamp from the logfile into @timestamp. However since logstash 6.5.0 that is not working anymore which results that data not being imported in elasticsearch. The … --- ## [What's the meaning of "?\>" in the regular expression](https://discuss.elastic.co/t/whats-the-meaning-of-in-the-regular-expression/157899)
**Author:** [@thorzhang](https://discuss.elastic.co/u/thorzhang)\ **Replies:** 1\ **Last updated:** [November 23, 2018, 10:13am UTC](https://discuss.elastic.co/t/whats-the-meaning-of-in-the-regular-expression/157899 "2018-11-23T10:13:10Z")
Below is a regular expression In grok-patterns (url: https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns), I don't know the meanings of "?\>". YEAR (?\>\\d\\d){1,2} Can anyone help… --- ## [Problem parsing a datestring - Grok Debugger shows no problem](https://discuss.elastic.co/t/problem-parsing-a-datestring-grok-debugger-shows-no-problem/157639)
**Author:** [@faulander](https://discuss.elastic.co/u/faulander)\ **Replies:** 5\ **Last updated:** [November 23, 2018, 10:05am UTC](https://discuss.elastic.co/t/problem-parsing-a-datestring-grok-debugger-shows-no-problem/157639 "2018-11-23T10:05:37Z")
Example Logfile Entry which works perfectly in the Grok Debugger: 2018-11-21 08:15:54,809 WARN \[com.xxx.mediaserver.tools.maintenance.FileMaintenance\] (Thread-6) Not removing directory C:\\xxx\\mediaserver\\import\_export… --- ## [Logstash throwing error when trying to start on Fedoracore 22](https://discuss.elastic.co/t/logstash-throwing-error-when-trying-to-start-on-fedoracore-22/157981)
**Author:** [@sukeerthi\_bj](https://discuss.elastic.co/u/sukeerthi_bj)\ **Replies:** 0\ **Last updated:** [November 23, 2018, 9:56am UTC](https://discuss.elastic.co/t/logstash-throwing-error-when-trying-to-start-on-fedoracore-22/157981 "2018-11-23T09:56:01Z")
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash\_CPS.conf -t --debug LoadError: load error: jopenssl/load -- java.lang.InternalError: null require at org/jruby/RubyKernel.java:1040 (root) at /usr/shar… --- ## [Problem adding Logstash to Kibana monitoring](https://discuss.elastic.co/t/problem-adding-logstash-to-kibana-monitoring/157638)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 8\ **Last updated:** [November 23, 2018, 8:51am UTC](https://discuss.elastic.co/t/problem-adding-logstash-to-kibana-monitoring/157638 "2018-11-23T08:51:16Z")
Hi All, I have a problem to add Logstash monitoring to Kibana. I have followed the configuration guidelines, but the Logstash widget does not appear on Kibana Monitoring tab. My logstash.yml: node.name: node-1 path.d… --- ## [Multiline codec plugin with no output](https://discuss.elastic.co/t/multiline-codec-plugin-with-no-output/157974)
**Author:** [@opser](https://discuss.elastic.co/u/opser)\ **Replies:** 0\ **Last updated:** [November 23, 2018, 8:52am UTC](https://discuss.elastic.co/t/multiline-codec-plugin-with-no-output/157974 "2018-11-23T08:52:11Z")
Hi, I'm trying to use Multiline codec plugin with Logstash config file: input { file { path =\> "/path/to/file" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" … --- ## [Delete syslog fields from logstream](https://discuss.elastic.co/t/delete-syslog-fields-from-logstream/157891)
**Author:** [@Gegi\_K](https://discuss.elastic.co/u/Gegi_K)\ **Replies:** 2\ **Last updated:** [November 23, 2018, 7:27am UTC](https://discuss.elastic.co/t/delete-syslog-fields-from-logstream/157891 "2018-11-23T07:27:42Z")
Hi there, Sorry if this question is being stupid, but I'm trying to get something weitrd working... the deal is I have some Firewalls which send some data to ElasticSearch via LogStash. all works fine, except the only f… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=642) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=644)