# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=650 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 651 --- ## [Grok matcher acting strange, works fine in grokconstructor](https://discuss.elastic.co/t/grok-matcher-acting-strange-works-fine-in-grokconstructor/156317)
**Author:** [@xeon28](https://discuss.elastic.co/u/xeon28)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 4:04pm UTC](https://discuss.elastic.co/t/grok-matcher-acting-strange-works-fine-in-grokconstructor/156317 "2018-11-12T16:04:02Z")
I'm using the below pattern to match these example logs: 2018-11-12 10:21:33,596\[event-thread-1\]INFO (HTTP-ENTRY)-ef8684ae-72a4-4ad7-94f9-603e7999b3a4 Get Request to /session with method POST from 10.134.2… --- ## [Logstash JDBC plugin and high availability](https://discuss.elastic.co/t/logstash-jdbc-plugin-and-high-availability/156322)
**Author:** [@anp](https://discuss.elastic.co/u/anp)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 4:24pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-and-high-availability/156322 "2018-11-12T16:24:10Z")
I have an Elasticsearch cluster populated via the Logstash JDBC plugin, Is there a way to make Logstash highly available? Ideally I want only one instance of Logstash polling the relational database at a time and have th… --- ## [Mutiple logstash instances using jdbc\_input to avoid spof](https://discuss.elastic.co/t/mutiple-logstash-instances-using-jdbc-input-to-avoid-spof/156314)
**Author:** [@Christophe\_Journel](https://discuss.elastic.co/u/Christophe_Journel)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 3:48pm UTC](https://discuss.elastic.co/t/mutiple-logstash-instances-using-jdbc-input-to-avoid-spof/156314 "2018-11-12T15:48:47Z")
Hello, I have a pipeline which uses jdbc\_input once per night. However, I would like to use 2 servers ( with one logstash per server) just in case one of these server crashes. But i dont want to run the job on the 2 s… --- ## [Geoip with different sources](https://discuss.elastic.co/t/geoip-with-different-sources/156310)
**Author:** [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 3:21pm UTC](https://discuss.elastic.co/t/geoip-with-different-sources/156310 "2018-11-12T15:21:04Z")
Hello, I send logs from mail server from two sources 1 audit.log (only authorization) 2 mail.log (send and receive emails log) For more flexibility I have next fields server1.audit.sender\_ip server1.audit.recepient… --- ## [Logstash not showing any output while connecting to Oracle DB](https://discuss.elastic.co/t/logstash-not-showing-any-output-while-connecting-to-oracle-db/156309)
**Author:** [@Vishal088](https://discuss.elastic.co/u/Vishal088)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 3:14pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-while-connecting-to-oracle-db/156309 "2018-11-12T15:14:41Z")
I'm starting off with Logstash, working through the tutorials. I ma facing issue while trying to extract data as standard output from oracle. I have created below sample config file:- input { jdbc { jdbc\_validate\_con… --- ## [Problem with grok filter in logstash](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772)
**Author:** [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)\ **Replies:** 4\ **Last updated:** [November 12, 2018, 3:11pm UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772 "2018-11-12T15:11:29Z")
Hello, I have latest version of ELK stack on target server I have filebeat filebeat version 6.4.2 on server I received message like that 2018-10-31 10:12:09,679 INFO \[Pop3SSLServer-119\] \[ip=xxx.xx.xx.xxx;oip=xxx.xx… --- ## [Pinning Multiple SSL Certificates in Logstash HTTP input plugin](https://discuss.elastic.co/t/pinning-multiple-ssl-certificates-in-logstash-http-input-plugin/156296)
**Author:** [@dyongbcst](https://discuss.elastic.co/u/dyongbcst)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 1:39pm UTC](https://discuss.elastic.co/t/pinning-multiple-ssl-certificates-in-logstash-http-input-plugin/156296 "2018-11-12T13:39:58Z")
Hi, I would like to check if there are any methods to pin 2 SSL certificates to the logstash http input? Currently, the ssl\_certificate field only allows for 1 certificate to be added. --- ## [Logstash not sending logs to custom elasticsearch index](https://discuss.elastic.co/t/logstash-not-sending-logs-to-custom-elasticsearch-index/156288)
**Author:** [@ishtikhark](https://discuss.elastic.co/u/ishtikhark)\ **Replies:** 1\ **Last updated:** [November 12, 2018, 12:35pm UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-custom-elasticsearch-index/156288 "2018-11-12T12:35:58Z")
Here is my filebeat.yml configuration file #=========================== Filebeat inputs ============================= filebeat.inputs: Each - is an input. Most options can be set at the input level, so you can use dif… --- ## [Change date format from 2/23/1944 to 1944-02-23](https://discuss.elastic.co/t/change-date-format-from-2-23-1944-to-1944-02-23/156280)
**Author:** [@ravian100](https://discuss.elastic.co/u/ravian100)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 11:12am UTC](https://discuss.elastic.co/t/change-date-format-from-2-23-1944-to-1944-02-23/156280 "2018-11-12T11:12:46Z")
Here is my logstash.conf filter section filter { csv { separator =\> ";" columns =\> \[ "Nummer","HP\_VP","HP\_VN","HP\_VP\_VORNAME","HP\_VN\_VORNAME","HP\_VP\_NACHNAME","HP\_VN\_NACHNAME","ADDRESS","DateOfBirth" \] } date { … --- ## [HELP! I want to split date. using split filter](https://discuss.elastic.co/t/help-i-want-to-split-date-using-split-filter/156273)
**Author:** [@levi\_munthe](https://discuss.elastic.co/u/levi_munthe)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 10:19am UTC](https://discuss.elastic.co/t/help-i-want-to-split-date-using-split-filter/156273 "2018-11-12T10:19:01Z")
2018-08-28 08:08:05 172.168.0.100 GET / - 80 - 66.249.71.153 Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html) - 200 0 0 13453 Filter. filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO86… --- ## [S3 input plugin - add path field, preserve folder hierarchy during backup?](https://discuss.elastic.co/t/s3-input-plugin-add-path-field-preserve-folder-hierarchy-during-backup/156259)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 9:20am UTC](https://discuss.elastic.co/t/s3-input-plugin-add-path-field-preserve-folder-hierarchy-during-backup/156259 "2018-11-12T09:20:45Z")
While pushing logs from local to ES using file input plugin, a path field gets added which contains the actual path of the log file which the document was created from. But this field doesn't show up when using the AWS s… --- ## [Error: org.postgresql.Driver not loaded](https://discuss.elastic.co/t/error-org-postgresql-driver-not-loaded/155850)
**Author:** [@elasitcboy](https://discuss.elastic.co/u/elasitcboy)\ **Replies:** 1\ **Last updated:** [November 12, 2018, 9:02am UTC](https://discuss.elastic.co/t/error-org-postgresql-driver-not-loaded/155850 "2018-11-12T09:02:58Z")
I have problem with jdbc\_driver\_library. ELK\_VERSION = 6.4.2 And I use Docker for elk. when i run: /opt/logstash# bin/logstash --path.data=/opt/logstash/ -f /etc/logstash/conf.d/simple.conf Get Error: Error: org.po… --- ## [Extracting response code from the log message?](https://discuss.elastic.co/t/extracting-response-code-from-the-log-message/156254)
**Author:** [@roly](https://discuss.elastic.co/u/roly)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 8:36am UTC](https://discuss.elastic.co/t/extracting-response-code-from-the-log-message/156254 "2018-11-12T08:36:21Z")
78731233 \* Client response received on thread ap-578543 - POST /batch/newitem/listing 78731233 \< 200 how can i extract response code from the above using grok? kindly suggest!! --- ## [Logstash stuck on "Attempted to resurrect connection to dead ES instance" for days](https://discuss.elastic.co/t/logstash-stuck-on-attempted-to-resurrect-connection-to-dead-es-instance-for-days/156252)
**Author:** [@Oferkes](https://discuss.elastic.co/u/Oferkes)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 8:31am UTC](https://discuss.elastic.co/t/logstash-stuck-on-attempted-to-resurrect-connection-to-dead-es-instance-for-days/156252 "2018-11-12T08:31:15Z")
Hi, i have 55 client nodes in my Elastic cluster, which are all configured as back-end servers under HAProxy. In Logstash, at output filter, the 'hosts =\>' configuration is set to HAProxy address, and for weeks everyt… --- ## [How to split and label fields of an array of arrany?](https://discuss.elastic.co/t/how-to-split-and-label-fields-of-an-array-of-arrany/156235)
**Author:** [@Chuan\_Ydnk](https://discuss.elastic.co/u/Chuan_Ydnk)\ **Replies:** 2\ **Last updated:** [November 12, 2018, 8:22am UTC](https://discuss.elastic.co/t/how-to-split-and-label-fields-of-an-array-of-arrany/156235 "2018-11-12T08:22:40Z")
Hi I have the following output after i had used filter { json { source =\> "message" } } Now, I wanted to split the array of objects The first field is link\_name, link\_alias, bto,bcs,bss. I am sorry really a newbie in… --- ## [Binding core to logstash instance](https://discuss.elastic.co/t/binding-core-to-logstash-instance/156245)
**Author:** [@venki522](https://discuss.elastic.co/u/venki522)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 7:48am UTC](https://discuss.elastic.co/t/binding-core-to-logstash-instance/156245 "2018-11-12T07:48:14Z")
can we bind specific cores to a single logstash instance ? --- ## [Current token (VALUE\_TRUE) not numeric, can not use numeric value accessors](https://discuss.elastic.co/t/current-token-value-true-not-numeric-can-not-use-numeric-value-accessors/156238)
**Author:** [@muyuqj](https://discuss.elastic.co/u/muyuqj)\ **Replies:** 0\ **Last updated:** [November 12, 2018, 7:02am UTC](https://discuss.elastic.co/t/current-token-value-true-not-numeric-can-not-use-numeric-value-accessors/156238 "2018-11-12T07:02:31Z")
In mysql, the status field type is tinyint, but when retrieved from jdbc, it becomes boolean, with only true and false This status field has several values, not only 0 and 1, but also 2.My configuration is： { "templat… --- ## [How to get logstash works](https://discuss.elastic.co/t/how-to-get-logstash-works/156221)
**Author:** [@liuuu](https://discuss.elastic.co/u/liuuu)\ **Replies:** 6\ **Last updated:** [November 12, 2018, 7:24am UTC](https://discuss.elastic.co/t/how-to-get-logstash-works/156221 "2018-11-12T07:24:05Z")
my csv file like below id,title,original\_air\_date,production\_code,season,number\_in\_season,number\_in\_series,us\_viewers\_in\_millions,views,imdb\_rating,imdb\_votes,image\_url,video\_url 10,Homer's Night Out,1990-03-25,7… --- ## [Retryable error when running logstash config](https://discuss.elastic.co/t/retryable-error-when-running-logstash-config/156228)
**Author:** [@Eva](https://discuss.elastic.co/u/Eva)\ **Replies:** 3\ **Last updated:** [November 12, 2018, 5:50am UTC](https://discuss.elastic.co/t/retryable-error-when-running-logstash-config/156228 "2018-11-12T05:50:04Z")
Hello there I'm new to ELk and playing around with diff logstash confg. While running the same, i see below error: \[ERROR\] 2018-11-12 04:44:37.028 \[\[main\]\>worker1\] elasticsearch - Encountered a retryable error. Will Re… --- ## [How to use grok then start a record with time](https://discuss.elastic.co/t/how-to-use-grok-then-start-a-record-with-time/155686)
**Author:** [@aabababba](https://discuss.elastic.co/u/aabababba)\ **Replies:** 2\ **Last updated:** [November 12, 2018, 2:10am UTC](https://discuss.elastic.co/t/how-to-use-grok-then-start-a-record-with-time/155686 "2018-11-12T02:10:03Z")
Nov 06, 2018 3:29:10 PM org.apache.catalina.core.StandardWrapperValve invoke SEVERE: Servlet.service() for servlet \[spring\] in context with path \[\] threw exception \[Request processing failed; nested exception is java.lan… --- ## [JDBC input...how to capture query duration in metadata](https://discuss.elastic.co/t/jdbc-input-how-to-capture-query-duration-in-metadata/156208)
**Author:** [@Chris\_Lyons](https://discuss.elastic.co/u/Chris_Lyons)\ **Replies:** 0\ **Last updated:** [November 11, 2018, 4:11pm UTC](https://discuss.elastic.co/t/jdbc-input-how-to-capture-query-duration-in-metadata/156208 "2018-11-11T16:11:33Z")
After the Logstash JDBC Input executes a query it writes out the duration seconds in the log file with the executed statement. Does anyone know where I can capture that value in the code and place it in a metadata field… --- ## [Ruby Filter Exception: No implicit conversion of Fixnum into String](https://discuss.elastic.co/t/ruby-filter-exception-no-implicit-conversion-of-fixnum-into-string/156192)
**Author:** [@dx123](https://discuss.elastic.co/u/dx123)\ **Replies:** 0\ **Last updated:** [November 11, 2018, 10:34am UTC](https://discuss.elastic.co/t/ruby-filter-exception-no-implicit-conversion-of-fixnum-into-string/156192 "2018-11-11T10:34:24Z")
Here is my aggregation query: { "size": 0, "aggs": { "range": { "date\_range": { "field": "source time", "ranges": \[ { "from": "2018-01-01", "to": "now/d" … --- ## [ConfigurationError", :message=\>"Expected one of #, input, filter, output at line 1, column 1](https://discuss.elastic.co/t/configurationerror-message-expected-one-of-input-filter-output-at-line-1-column-1/156154)
**Author:** [@numan\_KIZILIRMAK](https://discuss.elastic.co/u/numan_KIZILIRMAK)\ **Replies:** 6\ **Last updated:** [November 11, 2018, 9:51am UTC](https://discuss.elastic.co/t/configurationerror-message-expected-one-of-input-filter-output-at-line-1-column-1/156154 "2018-11-11T09:51:00Z")
Hello, I want to get rabitmq messages from rabitmq to elasticsearch via logstash my config is: input { rabbitmq { host ⇒ "localhost" queue =\> "LoggingToElastic" exchange =\> "LogQueue" durable =\> true user =\> "gue… --- ## [Multiple tables in csv file](https://discuss.elastic.co/t/multiple-tables-in-csv-file/155547)
**Author:** [@kalyani](https://discuss.elastic.co/u/kalyani)\ **Replies:** 6\ **Last updated:** [November 10, 2018, 6:38pm UTC](https://discuss.elastic.co/t/multiple-tables-in-csv-file/155547 "2018-11-10T18:38:49Z")
Hello, I have a csv file for a order management system . How do I write the filter in the conf file for this data? I tried separating using ",,,,,,,,,,,,,,,,,,,,,,,," , but cant form proper json in the output.\\ Plea… --- ## [Logstash Configuration when removing specified type mapping](https://discuss.elastic.co/t/logstash-configuration-when-removing-specified-type-mapping/156148)
**Author:** [@Josh\_cullum](https://discuss.elastic.co/u/Josh_cullum)\ **Replies:** 4\ **Last updated:** [November 10, 2018, 5:42pm UTC](https://discuss.elastic.co/t/logstash-configuration-when-removing-specified-type-mapping/156148 "2018-11-10T17:42:11Z")
Hi, There is probably a simple fix to this. We've recently upgrade our elastic stack from 5.3 to 6.4, and we're having the mapping issues that many other people are having but we seem to be using it in a slightly differ… --- ## [Logstach Netflow IPFIX decode error](https://discuss.elastic.co/t/logstach-netflow-ipfix-decode-error/156144)
**Author:** [@leonel.santos](https://discuss.elastic.co/u/leonel.santos)\ **Replies:** 0\ **Last updated:** [November 10, 2018, 2:06pm UTC](https://discuss.elastic.co/t/logstach-netflow-ipfix-decode-error/156144 "2018-11-10T14:06:58Z")
Hi. A problem of this kind is happening to me too. When I export IPFIX flows via TCP or UDP to logstach within the same network, no problem. I can see the IPFIX flows in Elastiflow Kibana Dashboards. When I have the I… --- ## [Not able to use Elastisearch out of network](https://discuss.elastic.co/t/not-able-to-use-elastisearch-out-of-network/156084)
**Author:** [@iastroleo](https://discuss.elastic.co/u/iastroleo)\ **Replies:** 2\ **Last updated:** [November 10, 2018, 2:03pm UTC](https://discuss.elastic.co/t/not-able-to-use-elastisearch-out-of-network/156084 "2018-11-10T14:03:29Z")
Hey everybody! I am trying to create a network scenario for flow capture using YAF to export the flows on to logstash to view them on Kibana using elastiflow. This works great if all the devices are on the same network,… --- ## [Drop filter for multiple integer values of a field?](https://discuss.elastic.co/t/drop-filter-for-multiple-integer-values-of-a-field/156143)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 0\ **Last updated:** [November 10, 2018, 1:55pm UTC](https://discuss.elastic.co/t/drop-filter-for-multiple-integer-values-of-a-field/156143 "2018-11-10T13:55:14Z")
I'm trying to filter out netflow packets to have only documents indexed that are for the protocol types that I am interested in. There are multiple integers that I want to have those documents indexed in ElasticSearch, … --- ## [Conditional GeoIP enrichment or merge two MaxMind databases?](https://discuss.elastic.co/t/conditional-geoip-enrichment-or-merge-two-maxmind-databases/156141)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 0\ **Last updated:** [November 10, 2018, 1:30pm UTC](https://discuss.elastic.co/t/conditional-geoip-enrichment-or-merge-two-maxmind-databases/156141 "2018-11-10T13:30:14Z")
I'm looking to enrich netflow data with Logstash, and I have two MaxMind GeoIP databases - one with public IP address ranges and another with the private address ranges that we use in our Enterprise. What is the best pr… --- ## [Grok can't do what dissect does](https://discuss.elastic.co/t/grok-cant-do-what-dissect-does/156134)
**Author:** [@aruntracer](https://discuss.elastic.co/u/aruntracer)\ **Replies:** 1\ **Last updated:** [November 10, 2018, 1:17pm UTC](https://discuss.elastic.co/t/grok-cant-do-what-dissect-does/156134 "2018-11-10T13:17:47Z")
test.log Sat Nov 30 21:36:25 IST 2013;404112130710695;8377828305;ROHIT KUMAR;0,PM - Prepaid Mercury,5401;11166;Del\_Delhi\_South Delhi\_SD\_IBC\_T3\_Terminal\_Intern\_166\_5401 this log is easily parsed using dissect filter by… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=649) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=651)