# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=670 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 671 --- ## [java.lang.IllegalSta teException: org.jruby.exceptions.RaiseException: (LoadError) no such file to lo ad -- /ELK/logstash-6.2.3/bin/mysql-connector-java-5.1.47-bin](https://discuss.elastic.co/t/java-lang-illegalsta-teexception-org-jruby-exceptions-raiseexception-loaderror-no-such-file-to-lo-ad-elk-logstash-6-2-3-bin-mysql-connector-java-5-1-47-bin/151972)
**Author:** [@emma1](https://discuss.elastic.co/u/emma1)\ **Replies:** 3\ **Last updated:** [October 11, 2018, 7:00am UTC](https://discuss.elastic.co/t/java-lang-illegalsta-teexception-org-jruby-exceptions-raiseexception-loaderror-no-such-file-to-lo-ad-elk-logstash-6-2-3-bin-mysql-connector-java-5-1-47-bin/151972 "2018-10-11T07:00:52Z")
Hi All, My Config file is input { jdbc { jdbc\_driver\_library =\> "/ELK/logstash-6.2.3/mysql-connector-java-5.1.47/mysql-connector-java-5.1.47-bin.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" jdbc\_connection\_str… --- ## [If we want to aggregate logs from multiple CF applications, what is the recommended approach to do this?](https://discuss.elastic.co/t/if-we-want-to-aggregate-logs-from-multiple-cf-applications-what-is-the-recommended-approach-to-do-this/151996)
**Author:** [@surbhi\_jain](https://discuss.elastic.co/u/surbhi_jain)\ **Replies:** 0\ **Last updated:** [October 11, 2018, 7:00am UTC](https://discuss.elastic.co/t/if-we-want-to-aggregate-logs-from-multiple-cf-applications-what-is-the-recommended-approach-to-do-this/151996 "2018-10-11T07:00:18Z")
I have to bind multiple apps from two cloud foundries and visualize the logs such that they are distinguished on kibana. What could be the right way to do this? --- ## [Logstash Email Alert Body Customization](https://discuss.elastic.co/t/logstash-email-alert-body-customization/151983)
**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 0\ **Last updated:** [October 11, 2018, 6:16am UTC](https://discuss.elastic.co/t/logstash-email-alert-body-customization/151983 "2018-10-11T06:16:25Z")
Does anyone know how to line break in logstash email output body part? My current filter is this, if "warning" in \[tags\] { email { to =\> "its@company.com" address =\> "smtp.gmail.com" po… --- ## [Logstash errors after SSL setup](https://discuss.elastic.co/t/logstash-errors-after-ssl-setup/151690)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 2\ **Last updated:** [October 11, 2018, 5:01am UTC](https://discuss.elastic.co/t/logstash-errors-after-ssl-setup/151690 "2018-10-11T05:01:38Z")
Hello there: I set up the SSL /TLS on logstash/elasticsearch and kibnana as indicated above. Everything looks fine, all are up and running, and I can see the beats(file/metric/etc...) are sending data on Kibana (Discov… --- ## [Store number of subfields into one field](https://discuss.elastic.co/t/store-number-of-subfields-into-one-field/151826)
**Author:** [@deepsing](https://discuss.elastic.co/u/deepsing)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 10:56am UTC](https://discuss.elastic.co/t/store-number-of-subfields-into-one-field/151826 "2018-10-10T10:56:44Z")
I have a field with name event.action.arguments in logs. There are the numbers of subfield under event.action.arguments. eg: { "event": { "action": { "arguments": { "First\_argument": { "1st\_sub": 123, … --- ## [Complete Example - Adding Private IPs for Internal Networks](https://discuss.elastic.co/t/complete-example-adding-private-ips-for-internal-networks/151960)
**Author:** [@ericbarnes](https://discuss.elastic.co/u/ericbarnes)\ **Replies:** 1\ **Last updated:** [October 11, 2018, 3:07am UTC](https://discuss.elastic.co/t/complete-example-adding-private-ips-for-internal-networks/151960 "2018-10-11T03:07:44Z")
I recognize there are a lot of posts on here about this topic but they are (in my opinion) partially complete. In general they lack (or I feel they lack) context around the full environment or the rest of the config file… --- ## [Cannot create new index/template with geo-point field?](https://discuss.elastic.co/t/cannot-create-new-index-template-with-geo-point-field/151919)
**Author:** [@rhc17](https://discuss.elastic.co/u/rhc17)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 6:43pm UTC](https://discuss.elastic.co/t/cannot-create-new-index-template-with-geo-point-field/151919 "2018-10-10T18:43:48Z")
Hi, new to this and have been wrestling with this for the past few days. I am trying to get a Logstash .csv import to Elasticsearch to work correctly, but am running into trouble with getting my geo-point field in. Spec… --- ## [Problem extracting multiple events from XML](https://discuss.elastic.co/t/problem-extracting-multiple-events-from-xml/151943)
**Author:** [@DWee](https://discuss.elastic.co/u/DWee)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 9:39pm UTC](https://discuss.elastic.co/t/problem-extracting-multiple-events-from-xml/151943 "2018-10-10T21:39:20Z")
Hello, I've been struggling with this for a few days now and have been trolling endlessly in the community for some complete examples to help me out. I am currently have a problem trying to parse all the events from my… --- ## [Persistent Queue problems in k8s on AWS](https://discuss.elastic.co/t/persistent-queue-problems-in-k8s-on-aws/151720)
**Author:** [@RobertRTune](https://discuss.elastic.co/u/RobertRTune)\ **Replies:** 1\ **Last updated:** [October 10, 2018, 9:52pm UTC](https://discuss.elastic.co/t/persistent-queue-problems-in-k8s-on-aws/151720 "2018-10-10T21:52:25Z")
We're currently looking into migrating our logstash cluster from ec2 instances to kubernetes. We're seeing some odd behavior in the persistent queue compared to our legacy implementation. Our legacy logstash cluster uses… --- ## [Help with Aggregate/Multiline](https://discuss.elastic.co/t/help-with-aggregate-multiline/151933)
**Author:** [@TehMuffinMoo](https://discuss.elastic.co/u/TehMuffinMoo)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 8:19pm UTC](https://discuss.elastic.co/t/help-with-aggregate-multiline/151933 "2018-10-10T20:19:51Z")
I'm looking to the community to hopefully shed some light on how I can achieve this. I've got some unstructured multi-line data with a definitive start and end event. I'm struggling to figure out if I should be using Mul… --- ## [Event.append() on Logstash 6](https://discuss.elastic.co/t/event-append-on-logstash-6/151927)
**Author:** [@decibel83](https://discuss.elastic.co/u/decibel83)\ **Replies:** 1\ **Last updated:** [October 10, 2018, 8:18pm UTC](https://discuss.elastic.co/t/event-append-on-logstash-6/151927 "2018-10-10T20:18:43Z")
I'm trying to use the Logstash aggregate filter on Postfix logs using a filter taken from https://github.com/topmedia/logstash-postfix/blob/master/etc/logstash/conf.d/51-filter-postfix-aggregate.conf. I modified the fil… --- ## [Removing surrounding double quotes](https://discuss.elastic.co/t/removing-surrounding-double-quotes/151931)
**Author:** [@danshenry](https://discuss.elastic.co/u/danshenry)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 8:07pm UTC](https://discuss.elastic.co/t/removing-surrounding-double-quotes/151931 "2018-10-10T20:07:45Z")
Im reading values from a kafka topic and performing a few clean up tasks, the data from Kafka has all fields as strings (surrounded by double quotes), even including integers and floats. and i'm trying to convert them to… --- ## [Grok filter not working as expected](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/150941)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 2\ **Last updated:** [October 10, 2018, 7:42pm UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/150941 "2018-10-10T19:42:02Z")
I am attempting to parse in index log files where the "source" field sometimes contains strings and other times objects. The goal is to identify if the source is JSON and if so rename the source field to something else s… --- ## [How to convert a boolean value to string when ingesting with Logstash](https://discuss.elastic.co/t/how-to-convert-a-boolean-value-to-string-when-ingesting-with-logstash/150812)
**Author:** [@rohini\_basu](https://discuss.elastic.co/u/rohini_basu)\ **Replies:** 3\ **Last updated:** [October 10, 2018, 7:33pm UTC](https://discuss.elastic.co/t/how-to-convert-a-boolean-value-to-string-when-ingesting-with-logstash/150812 "2018-10-10T19:33:24Z")
Hi, I have a CSV file that I am currently ingesting via Logstash. I have a column 'Status' with 0 and 1 value. Currently I am ingesting this Status column as a boolean value and as a result of which I am getting True … --- ## [Logstash and the famous flushing of pipelines](https://discuss.elastic.co/t/logstash-and-the-famous-flushing-of-pipelines/151626)
**Author:** [@Carlos\_Magalhaes](https://discuss.elastic.co/u/Carlos_Magalhaes)\ **Replies:** 4\ **Last updated:** [October 10, 2018, 7:32pm UTC](https://discuss.elastic.co/t/logstash-and-the-famous-flushing-of-pipelines/151626 "2018-10-10T19:32:06Z")
Hi all, I have got almost every module working on ELK and really enjoying ELK. There is one caveat which I just can't get around and its been keeping me up till early hours of the morning :slight\_smile: I have filebeat… --- ## [Logstash unable to load csv data into elasticsearch on windows](https://discuss.elastic.co/t/logstash-unable-to-load-csv-data-into-elasticsearch-on-windows/150964)
**Author:** [@cj\_vegi](https://discuss.elastic.co/u/cj_vegi)\ **Replies:** 8\ **Last updated:** [October 10, 2018, 6:03pm UTC](https://discuss.elastic.co/t/logstash-unable-to-load-csv-data-into-elasticsearch-on-windows/150964 "2018-10-10T18:03:24Z")
Hi, I have been trying to load csv file into elasticsearch using logstash locally on windows 10. I had no success. The same configuration file seems to work on a mac sometimes. However, even on mac often fails without a… --- ## [SQL execute for full table](https://discuss.elastic.co/t/sql-execute-for-full-table/151708)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [October 10, 2018, 5:39pm UTC](https://discuss.elastic.co/t/sql-execute-for-full-table/151708 "2018-10-10T17:39:33Z")
I have configuration file that works pulling data from oracle database. document\_id also works and no more duplicate but everytime It runs it does full tablescan and takes forever to pull the data because table has milli… --- ## [Create custom pattern for specific name](https://discuss.elastic.co/t/create-custom-pattern-for-specific-name/151891)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [October 10, 2018, 4:52pm UTC](https://discuss.elastic.co/t/create-custom-pattern-for-specific-name/151891 "2018-10-10T16:52:13Z")
Hello all. i have a problem i can't parse a specific name principal name: tu02612 from my log-entry, i trid this costum pattern \[\\s principal name:\](?\\[a-z0-9\]{5,7})\[\\s\] but i didn't get any thing right. s… --- ## [WebHDFS output plugin fails to create new files](https://discuss.elastic.co/t/webhdfs-output-plugin-fails-to-create-new-files/151494)
**Author:** [@nich](https://discuss.elastic.co/u/nich)\ **Replies:** 0\ **Last updated:** [October 8, 2018, 4:20pm UTC](https://discuss.elastic.co/t/webhdfs-output-plugin-fails-to-create-new-files/151494 "2018-10-08T16:20:08Z")
We have a simple test configuration of Logstash sending to a MapR instance using WebHDFS (via the Logstash WebHDFS output plugin). Messages are successfully appended to existing files in MapR, but new files cannot be cre… --- ## [Merge two logs from Postfix](https://discuss.elastic.co/t/merge-two-logs-from-postfix/151885)
**Author:** [@decibel83](https://discuss.elastic.co/u/decibel83)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 3:53pm UTC](https://discuss.elastic.co/t/merge-two-logs-from-postfix/151885 "2018-10-10T15:53:43Z")
Hi, I am delivering logs from Postfix to Logstash and I am displaying them on a Kibana dashboard to find out not-delivered or bounced e-mails. The problem is that Postfix inserts important information about the message… --- ## [Logstash v6.2.2 - Elasticsearch plugin Query - Duplicate Data](https://discuss.elastic.co/t/logstash-v6-2-2-elasticsearch-plugin-query-duplicate-data/151604)
**Author:** [@martb](https://discuss.elastic.co/u/martb)\ **Replies:** 0\ **Last updated:** [October 9, 2018, 10:01am UTC](https://discuss.elastic.co/t/logstash-v6-2-2-elasticsearch-plugin-query-duplicate-data/151604 "2018-10-09T10:01:10Z")
Hi, I have two indexes, malware-\*(contains a list of malware threats) and xxxx-main-controls, when the xxxx-2-3.conf (see below) runs it queries the malware index for a match to the urlpath field and if matched adds thr… --- ## [Stop reading from Kafka's topic by logstash in case of error (400,404)](https://discuss.elastic.co/t/stop-reading-from-kafkas-topic-by-logstash-in-case-of-error-400-404/151877)
**Author:** [@Ahrip](https://discuss.elastic.co/u/Ahrip)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 3:17pm UTC](https://discuss.elastic.co/t/stop-reading-from-kafkas-topic-by-logstash-in-case-of-error-400-404/151877 "2018-10-10T15:17:01Z")
Hello everyone, I have a question about error processing in Logstash. In my case, i have the following cluster: Kafka -\> Logstash -\> Elasticsearch As far as I understood, if Logstash reads messages from Kafka's topic … --- ## [Logstash not receiving data](https://discuss.elastic.co/t/logstash-not-receiving-data/151865)
**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 1\ **Last updated:** [October 10, 2018, 2:48pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data/151865 "2018-10-10T14:48:08Z")
Can somebody please help me setup logstash? I am trying to send the event logs from windows server to logstash and then to elasticsearch. I installed Elasticsearch and Kibana successfully. Then i installed logstash and c… --- ## [Flatten array in Logstash](https://discuss.elastic.co/t/flatten-array-in-logstash/151850)
**Author:** [@pastechecker](https://discuss.elastic.co/u/pastechecker)\ **Replies:** 2\ **Last updated:** [October 10, 2018, 2:08pm UTC](https://discuss.elastic.co/t/flatten-array-in-logstash/151850 "2018-10-10T14:08:09Z")
I am attempting to extract new values from array keys \[files\]\[MD5\] and create a new field for md5\_hashes that will contain the array keys. Input: "files": \[{ "SHA256": "1213447D713ECA24484983E754474D9D2F4A283D77DD… --- ## [Need help on logstash parsing](https://discuss.elastic.co/t/need-help-on-logstash-parsing/151291)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [October 10, 2018, 12:38pm UTC](https://discuss.elastic.co/t/need-help-on-logstash-parsing/151291 "2018-10-10T12:38:41Z")
Hi team, Would wanted to know how logstash will handle this data. I am collecting IOCs or generally called Indicators of Compromise and those are in a form of Domains or URLs. with certain bash commands I am extracting … --- ## [How to output pretty json to stdout](https://discuss.elastic.co/t/how-to-output-pretty-json-to-stdout/151339)
**Author:** [@panthersquirrel](https://discuss.elastic.co/u/panthersquirrel)\ **Replies:** 2\ **Last updated:** [October 10, 2018, 12:32pm UTC](https://discuss.elastic.co/t/how-to-output-pretty-json-to-stdout/151339 "2018-10-10T12:32:45Z")
I can't seem to find out how to output my log as pretty json to stdout. The default rubydebug output in my opinion is excruciating to look at. For example, I want the following log to look like this when printed to stdou… --- ## [To use a ruby filter to join the elements of each array into an array of objects logstash](https://discuss.elastic.co/t/to-use-a-ruby-filter-to-join-the-elements-of-each-array-into-an-array-of-objects-logstash/151845)
**Author:** [@balumurari1](https://discuss.elastic.co/u/balumurari1)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 12:11pm UTC](https://discuss.elastic.co/t/to-use-a-ruby-filter-to-join-the-elements-of-each-array-into-an-array-of-objects-logstash/151845 "2018-10-10T12:11:19Z")
Hello, can anyone please help me to use a ruby filter to join the elements of each array into an array of objects as shown in below image thanks in advance, --- ## [Is there any way to to put some messages on running logstash](https://discuss.elastic.co/t/is-there-any-way-to-to-put-some-messages-on-running-logstash/151836)
**Author:** [@chitreshg](https://discuss.elastic.co/u/chitreshg)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 11:46am UTC](https://discuss.elastic.co/t/is-there-any-way-to-to-put-some-messages-on-running-logstash/151836 "2018-10-10T11:46:30Z")
Hii all, I recently started to learn logstash, I have created a simple configuration file as shown below. Logstash is working fine without any issue but is there any way to put some message to know the logstash process,… --- ## [Dynamic dictionary in translate plugin](https://discuss.elastic.co/t/dynamic-dictionary-in-translate-plugin/151835)
**Author:** [@MartinG](https://discuss.elastic.co/u/MartinG)\ **Replies:** 0\ **Last updated:** [October 10, 2018, 11:42am UTC](https://discuss.elastic.co/t/dynamic-dictionary-in-translate-plugin/151835 "2018-10-10T11:42:52Z")
Hello community! I would like to use a dynamic dictionary with the translate plugin. Is this possible? The use case is, to define a dictionary in the "fields" configuration of filebeat and to check each element of the … --- ## [Indexing data by getting substring of each row](https://discuss.elastic.co/t/indexing-data-by-getting-substring-of-each-row/151391)
**Author:** [@prasad.ram1431](https://discuss.elastic.co/u/prasad.ram1431)\ **Replies:** 8\ **Last updated:** [October 10, 2018, 10:56am UTC](https://discuss.elastic.co/t/indexing-data-by-getting-substring-of-each-row/151391 "2018-10-10T10:56:20Z")
Hi All, I am new to logstash, I would like to index attached format of data into Elasticsearch using logstash. Could you please provide some samples, so that I can work on them. The Attached file doesn't contains heade… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=669) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=671)