# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=652 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 653 --- ## [S3 input tool](https://discuss.elastic.co/t/s3-input-tool/155911)
**Author:** [@roi\_romano](https://discuss.elastic.co/u/roi_romano)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 2:48pm UTC](https://discuss.elastic.co/t/s3-input-tool/155911 "2018-11-08T14:48:45Z")
I’m using logstash and es ( es is under AWS) and I have some issue with my logstash configuration. Logstash is already working and streaming logs to es and I see all on kibana. Example my Nginx logs. I installed the in… --- ## [No config files found in path](https://discuss.elastic.co/t/no-config-files-found-in-path/155889)
**Author:** [@fjblau](https://discuss.elastic.co/u/fjblau)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 12:56pm UTC](https://discuss.elastic.co/t/no-config-files-found-in-path/155889 "2018-11-08T12:56:38Z")
Getting: No config files found in path {:path=\>"/iappl/log\_conf/current/configs/cust/logstash.conf"} pipelines.yml: pipeline.id: scania path.config: "/iappl/log\_conf/current/configs/cust/logstash.conf" pipeline.wor… --- ## [Dropping multiple windows events in logstash](https://discuss.elastic.co/t/dropping-multiple-windows-events-in-logstash/155882)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 5\ **Last updated:** [November 8, 2018, 2:16pm UTC](https://discuss.elastic.co/t/dropping-multiple-windows-events-in-logstash/155882 "2018-11-08T14:16:13Z")
Hi There , Iam trying to drop multiple events in logstash , how to implement it As of now i use two different filters , but I want it in one filter filter { if "windows\_ad" in \[tags\] { if \[event\_id\] == 5157 { … --- ## [Logstash not capturing metrics](https://discuss.elastic.co/t/logstash-not-capturing-metrics/155893)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 1:24pm UTC](https://discuss.elastic.co/t/logstash-not-capturing-metrics/155893 "2018-11-08T13:24:11Z")
Ηere is the start of my filter filter { if "paloalto" in \[tags\] { metrics { meter =\> "events\_paloalto" flush\_interval =\> 60 add\_tag =\> "metric\_paloalto" } ... And here is section of my output if "metric\_paloal… --- ## [Weird comportment of logstash with integer datas](https://discuss.elastic.co/t/weird-comportment-of-logstash-with-integer-datas/155839)
**Author:** [@morihend](https://discuss.elastic.co/u/morihend)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 8:30am UTC](https://discuss.elastic.co/t/weird-comportment-of-logstash-with-integer-datas/155839 "2018-11-08T08:30:35Z")
Hello everybody, I have a very weird comportment of logstash when I try to collect integers datas from jdbc input. All is ok when i collect them alone (only the integers datas) but when i collect the same integers data… --- ## [Adding multiple unique ids to elapsed filter](https://discuss.elastic.co/t/adding-multiple-unique-ids-to-elapsed-filter/155825)
**Author:** [@chickennuggets](https://discuss.elastic.co/u/chickennuggets)\ **Replies:** 3\ **Last updated:** [November 8, 2018, 8:06am UTC](https://discuss.elastic.co/t/adding-multiple-unique-ids-to-elapsed-filter/155825 "2018-11-08T08:06:00Z")
What I'd like to do is find out if my 'merRequest' logs have a 'merResponse'. From the results, I want to be able to view the log's 'invoice\_id', 'm\_id' and 'm\_name' to be able to create visualizations involving the thre… --- ## [How to phrase the below date formate](https://discuss.elastic.co/t/how-to-phrase-the-below-date-formate/155834)
**Author:** [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 7:53am UTC](https://discuss.elastic.co/t/how-to-phrase-the-below-date-formate/155834 "2018-11-08T07:53:13Z")
Hi All, Need Help in phrase the below date format using logstash with Time Zone. in the below time there is no TZ is available. how to add the Time zone in the log using logstash. \[07-11-18 15:03:14,157 PM\] Thanks, … --- ## [The old Windows Event Log has been detected again](https://discuss.elastic.co/t/the-old-windows-event-log-has-been-detected-again/155821)
**Author:** [@foxtrot](https://discuss.elastic.co/u/foxtrot)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 5:43am UTC](https://discuss.elastic.co/t/the-old-windows-event-log-has-been-detected-again/155821 "2018-11-08T05:43:30Z")
I am using the Logstash 2.4.1 version. When Winodws Event Log matches the setting condition on the window server OS, a trap is sent. The problem is that once detected Windows Event logs are detected again and forward t… --- ## [Invalid config error](https://discuss.elastic.co/t/invalid-config-error/155818)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 1\ **Last updated:** [November 8, 2018, 5:36am UTC](https://discuss.elastic.co/t/invalid-config-error/155818 "2018-11-08T05:36:00Z")
Hi Team, I am trying to parse apache access and errors logs via filebeat input prospector, since i have multiple virtual instance configured on the same server like below. #=========================== Filebeat prospect… --- ## [Config works from CLI, doesn't work when running Logstash as a service](https://discuss.elastic.co/t/config-works-from-cli-doesnt-work-when-running-logstash-as-a-service/155810)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 1\ **Last updated:** [November 8, 2018, 2:44am UTC](https://discuss.elastic.co/t/config-works-from-cli-doesnt-work-when-running-logstash-as-a-service/155810 "2018-11-08T02:44:49Z")
Hi, I have a very strange problem where my config (http\_poller) works perfectly fine when I run it from the CLI (either as a normal user or sudo) but when I start logstash as a service it doesn't do anything. Logstash i… --- ## [GROK Filter failing to parse loglevel, RequestUUID fields with Logstash 2.0.5 and Grok 2](https://discuss.elastic.co/t/grok-filter-failing-to-parse-loglevel-requestuuid-fields-with-logstash-2-0-5-and-grok-2/155808)
**Author:** [@palmeti](https://discuss.elastic.co/u/palmeti)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 2:00am UTC](https://discuss.elastic.co/t/grok-filter-failing-to-parse-loglevel-requestuuid-fields-with-logstash-2-0-5-and-grok-2/155808 "2018-11-08T02:00:02Z")
Log4net log 2018-11-07 19:55:06,848 DEBUG CXYZ \[47\] 0HLI4IVM5VCGV:00000013 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker: Resource Filter: Before executing OnResourceExecuted on filter Microsoft.AspNetCore.M… --- ## [Newer versions of Logstash failing on Solaris](https://discuss.elastic.co/t/newer-versions-of-logstash-failing-on-solaris/155804)
**Author:** [@anthonyvia](https://discuss.elastic.co/u/anthonyvia)\ **Replies:** 0\ **Last updated:** [November 8, 2018, 12:46am UTC](https://discuss.elastic.co/t/newer-versions-of-logstash-failing-on-solaris/155804 "2018-11-08T00:46:52Z")
I'm having trouble getting newer versions of logstash running on Solaris (speficially, SmartOS). The newest version that is working for us is 6.1.3. All versions newer than that fail with this message: \[root@syslog02 ~\]… --- ## [File beat --\> logtash --\> conditional output](https://discuss.elastic.co/t/file-beat-logtash-conditional-output/155792)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 7\ **Last updated:** [November 7, 2018, 10:23pm UTC](https://discuss.elastic.co/t/file-beat-logtash-conditional-output/155792 "2018-11-07T22:23:12Z")
Hi I did research in this forum and documentation but couldn't find any solution so posting here for help. OS : windows 10 Filebeat : 6.4.2 sending 2 CSV files to Logstash File name London.csv , Australia.csv Logsta… --- ## [How to match and assign fields to a dynamic number of key values of the same name](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 4\ **Last updated:** [November 7, 2018, 9:46pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777 "2018-11-07T21:46:33Z")
In the auditd event below, there are two path names that need to be captured (name="/tmp" and name="file"). There could be multiple entries for the path name depending on the path accessed. I need to be able to dynamical… --- ## [Ansible Tower Integration with Logstash](https://discuss.elastic.co/t/ansible-tower-integration-with-logstash/155304)
**Author:** [@sunnypalsingh](https://discuss.elastic.co/u/sunnypalsingh)\ **Replies:** 1\ **Last updated:** [November 7, 2018, 9:22pm UTC](https://discuss.elastic.co/t/ansible-tower-integration-with-logstash/155304 "2018-11-07T21:22:55Z")
Hi Team, Just want to know if anyone body has integrated Ansible Tower with ELK. It would be really useful to reuse rather than re-inventing wheel. If nobody has done it, then I can show my configuration which is not wo… --- ## [Email formatting for ES with logstash pipline?](https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585)
**Author:** [@Jackson\_Pollock](https://discuss.elastic.co/u/Jackson_Pollock)\ **Replies:** 2\ **Last updated:** [November 7, 2018, 9:19pm UTC](https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585 "2018-11-07T21:19:16Z")
Using the imap plugin and am seeing email come across in a variety of formats, sometimes txt, html, or base64 encoded like: --000\_9DC799C9E1E4436E8FDA8B3339216EB3forescoutcom Content-Type: text/plain; charset=utf-8 C… --- ## [Input elasticsearch plugin and codec](https://discuss.elastic.co/t/input-elasticsearch-plugin-and-codec/155761)
**Author:** [@phr0gz](https://discuss.elastic.co/u/phr0gz)\ **Replies:** 0\ **Last updated:** [November 7, 2018, 4:37pm UTC](https://discuss.elastic.co/t/input-elasticsearch-plugin-and-codec/155761 "2018-11-07T16:37:55Z")
Hello, I'm trying get the raw value of %{message}, but whatever is the codec argument (in ES plugin) the result is always in json (without the field "message"). Test config: input { elasticsearch { hosts =\> "localho… --- ## [Delete the last field in an array on Logstash field](https://discuss.elastic.co/t/delete-the-last-field-in-an-array-on-logstash-field/155753)
**Author:** [@Akkyn](https://discuss.elastic.co/u/Akkyn)\ **Replies:** 1\ **Last updated:** [November 7, 2018, 4:08pm UTC](https://discuss.elastic.co/t/delete-the-last-field-in-an-array-on-logstash-field/155753 "2018-11-07T16:08:12Z")
Hi, Here is my logstash configuration file : input { file { path =\> "/usr/share/logstash/logs" codec =\> "cef" start\_position =\> "beginning" since… --- ## [Timestamp dateparseerror](https://discuss.elastic.co/t/timestamp-dateparseerror/155081)
**Author:** [@iamcyruss](https://discuss.elastic.co/u/iamcyruss)\ **Replies:** 1\ **Last updated:** [November 7, 2018, 3:42pm UTC](https://discuss.elastic.co/t/timestamp-dateparseerror/155081 "2018-11-07T15:42:41Z")
Hey all. I'm hoping someone could help me with this. I'm trying to get some logs setup properly but I can't seem to get the Timestamp to parse correctly. These are some examples of how my timestamp looks in the log files … --- ## [Xml filter for dynamic xml](https://discuss.elastic.co/t/xml-filter-for-dynamic-xml/155733)
**Author:** [@PeterSkarmyr](https://discuss.elastic.co/u/PeterSkarmyr)\ **Replies:** 0\ **Last updated:** [November 7, 2018, 1:49pm UTC](https://discuss.elastic.co/t/xml-filter-for-dynamic-xml/155733 "2018-11-07T13:49:06Z")
Hi I am still new to elasticsearch and are having som trouble importing xml-data and structuring this in a way that allows me to do meaningful aggeregations in kibana on the data from the xml. I am importing data from … --- ## [Geoip.asn type conversion/checking to integer occasionaly failing in logstash](https://discuss.elastic.co/t/geoip-asn-type-conversion-checking-to-integer-occasionaly-failing-in-logstash/155711)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 0\ **Last updated:** [November 7, 2018, 12:21pm UTC](https://discuss.elastic.co/t/geoip-asn-type-conversion-checking-to-integer-occasionaly-failing-in-logstash/155711 "2018-11-07T12:21:56Z")
Trying to parse and use in another field the geoip.asn value as follows: geoip { default\_database\_type =\> "ASN" source =\> "dst" } mutate { add\_field =\> \[ "\[dst\_asn\]", "%{geoip.asn}" \] # remove\_… --- ## [Logstash: Mutate/Add field with variable interpolation not working](https://discuss.elastic.co/t/logstash-mutate-add-field-with-variable-interpolation-not-working/155707)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [November 7, 2018, 11:55am UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-with-variable-interpolation-not-working/155707 "2018-11-07T11:55:34Z")
The following mutate / field addition with specific value is not working geoip { default\_database\_type =\> "ASN" source =\> "dst" } mutate { add\_field =\> \[ "\[dst\_asn\]", "%{geoip.asn}" \] # remove\_… --- ## [Syslog output plugin send rate limit](https://discuss.elastic.co/t/syslog-output-plugin-send-rate-limit/155699)
**Author:** [@SH\_HSOC](https://discuss.elastic.co/u/SH_HSOC)\ **Replies:** 0\ **Last updated:** [November 7, 2018, 11:11am UTC](https://discuss.elastic.co/t/syslog-output-plugin-send-rate-limit/155699 "2018-11-07T11:11:03Z")
Hi all, we are using logstash as part of our logging infrastructure and a prefilter to our SIEM system. The last step for this is to send events from logstash to the SIEM using syslog. To leverage the buffering capabil… --- ## [LogStash XMLFilter REXML::ParseException: No close tag](https://discuss.elastic.co/t/logstash-xmlfilter-rexml-no-close-tag/155084)
**Author:** [@Sankalan\_Banerjee](https://discuss.elastic.co/u/Sankalan_Banerjee)\ **Replies:** 5\ **Last updated:** [November 7, 2018, 10:56am UTC](https://discuss.elastic.co/t/logstash-xmlfilter-rexml-no-close-tag/155084 "2018-11-07T10:56:34Z")
Sample XML Doc : \ \C608690E65444B3F8A3B9DA25BA1493E\ D08B65929BEC48B5BB4B5FF2843CA3B5 \EGBO\_SANITY\_02\_AuthRes\ **Author:** [@nita](https://discuss.elastic.co/u/nita)\ **Replies:** 0\ **Last updated:** [November 7, 2018, 10:27am UTC](https://discuss.elastic.co/t/documents-fields-shown-in-different-sorting/155697 "2018-11-07T10:27:03Z") Hello, I have a Filebeat instance shipping logs from a single source to two different servers with Logstash running on both. I have copied and pasted the same following .conf file on both servers: input { beats { … --- ## [Elastic Cloud - xpack.management.enabled not working for logstash](https://discuss.elastic.co/t/elastic-cloud-xpack-management-enabled-not-working-for-logstash/155691)
**Author:** [@Nemnem](https://discuss.elastic.co/u/Nemnem)\ **Replies:** 1\ **Last updated:** [November 7, 2018, 9:17am UTC](https://discuss.elastic.co/t/elastic-cloud-xpack-management-enabled-not-working-for-logstash/155691 "2018-11-07T09:17:18Z")
I'm trying out Elastic Cloud ( trial ) and I couldn't find a category for it, so I apologize if this is in the wrong place. I'm trying to enable management for logstash pipelines, but I get an error message that makes m… --- ## [Mapping geo\_point data type in logstash](https://discuss.elastic.co/t/mapping-geo-point-data-type-in-logstash/155672)
**Author:** [@chinmoyd](https://discuss.elastic.co/u/chinmoyd)\ **Replies:** 2\ **Last updated:** [November 7, 2018, 9:13am UTC](https://discuss.elastic.co/t/mapping-geo-point-data-type-in-logstash/155672 "2018-11-07T09:13:24Z")
In my input JSON to logstash( input from a postgreSQL query), I have a string field containing the geolocation(example: 22.572645, 88.363892). The field name is payergeocode. When this data is going to Kibana through Ela… --- ## [Logstash: how to set start order of pipelines?](https://discuss.elastic.co/t/logstash-how-to-set-start-order-of-pipelines/155670)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [November 7, 2018, 7:41am UTC](https://discuss.elastic.co/t/logstash-how-to-set-start-order-of-pipelines/155670 "2018-11-07T07:41:46Z")
Hi, I am using about 30 pipelines in my logstash pipeline configuration. Since each pipeline takes about 30s to start, which is done sequentially, I would like to define starting priority in some kind. I noticed that the… --- ## [Logstash6.4.2 started by using docker-compose up, an error occurred: UDP listener died , Permission denied](https://discuss.elastic.co/t/logstash6-4-2-started-by-using-docker-compose-up-an-error-occurred-udp-listener-died-permission-denied/155480)
**Author:** [@sun\_changlong](https://discuss.elastic.co/u/sun_changlong)\ **Replies:** 4\ **Last updated:** [November 7, 2018, 2:38am UTC](https://discuss.elastic.co/t/logstash6-4-2-started-by-using-docker-compose-up-an-error-occurred-udp-listener-died-permission-denied/155480 "2018-11-07T02:38:13Z")
docker-compose.yml look like is: version: '2' services: logstash: image: logstash:6.4.2 container\_name: logstash privileged: true volumes: - ./data:/usr/share/logstash/data:rw - ./logs… --- ## [Scaling logstash on same windows server](https://discuss.elastic.co/t/scaling-logstash-on-same-windows-server/155634)
**Author:** [@cowensel](https://discuss.elastic.co/u/cowensel)\ **Replies:** 0\ **Last updated:** [November 6, 2018, 11:11pm UTC](https://discuss.elastic.co/t/scaling-logstash-on-same-windows-server/155634 "2018-11-06T23:11:59Z")
You have had a load of this type of question. We currently have an elk stack that logstash collects events from red is and then stores it in elasticsearch but the number of events are relatively small (around 2000 a day… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=651) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=653)