# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=683 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 684 --- ## [Logstash.licensechecker.licensemanager ERROR](https://discuss.elastic.co/t/logstash-licensechecker-licensemanager-error/148942)
**Author:** [@Victor\_De\_Castro](https://discuss.elastic.co/u/Victor_De_Castro)\ **Replies:** 1\ **Last updated:** [September 20, 2018, 5:59am UTC](https://discuss.elastic.co/t/logstash-licensechecker-licensemanager-error/148942 "2018-09-20T05:59:15Z")
Hello everybody, I'm facing a problem when i start or restart the logstash service :slight\_smile: \[2018-09-18T11:01:23,207\]\[ERROR\]\[logstash.licensechecker.licensemanager\] Unable to retrieve license information from lic… --- ## [When run logstash, it promts "Invalid initial heap size: -Xms5g"](https://discuss.elastic.co/t/when-run-logstash-it-promts-invalid-initial-heap-size-xms5g/149214)
**Author:** [@Zhao](https://discuss.elastic.co/u/Zhao)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 3:48am UTC](https://discuss.elastic.co/t/when-run-logstash-it-promts-invalid-initial-heap-size-xms5g/149214 "2018-09-20T03:48:01Z")
As my computer has 32g memory, so I changed the jvm.options to increase the memory of logstash. jvm.options is -Xms5g -Xmx8g but after change the jvm.options , it promts the belowing error when run logstash. root@EC… --- ## [How can logstash support daily rolling kafka topics?](https://discuss.elastic.co/t/how-can-logstash-support-daily-rolling-kafka-topics/149209)
**Author:** [@ysn2233](https://discuss.elastic.co/u/ysn2233)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 1:36am UTC](https://discuss.elastic.co/t/how-can-logstash-support-daily-rolling-kafka-topics/149209 "2018-09-20T01:36:31Z")
This is a continuous conversation of https://github.com/elastic/logstash/issues/10005 First I answer two questions repied by yaauie. What we think is to use topics like \["xxx\_20180919", "xxx\_20180920", "xxx\_20180921"… --- ## [Logstash keep throwing exceptions every few seconds](https://discuss.elastic.co/t/logstash-keep-throwing-exceptions-every-few-seconds/148476)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 7\ **Last updated:** [September 19, 2018, 11:53pm UTC](https://discuss.elastic.co/t/logstash-keep-throwing-exceptions-every-few-seconds/148476 "2018-09-19T23:53:19Z")
Backgroud: we have almost 200 beats client and a ELK cluster are consists of 20 ES data,3 master and 2 client nodes. logstash is a cluster with 4 nodes behind the haproxy. The archtechture like this: metricbeat/fileb… --- ## [Condition check](https://discuss.elastic.co/t/condition-check/148584)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 6\ **Last updated:** [September 19, 2018, 11:47pm UTC](https://discuss.elastic.co/t/condition-check/148584 "2018-09-19T23:47:23Z")
I have a field name errorcode which is of type NUMBER. How do i check the starting first digit of errorcode and place it as a ciondition in if statement. --- ## [I have a question](https://discuss.elastic.co/t/i-have-a-question/149145)
**Author:** [@sloppy](https://discuss.elastic.co/u/sloppy)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 9:19pm UTC](https://discuss.elastic.co/t/i-have-a-question/149145 "2018-09-19T21:19:00Z")
Novice trying to learn how all this works… I have WinBeatlog output to send to elesticsearch and I am able to see all my logs in kibana. What is the purpose of sending them to logstash then having logstash output to E… --- ## [Don't understand WRONG\_VERSION\_NUMBER errors](https://discuss.elastic.co/t/dont-understand-wrong-version-number-errors/149177)
**Author:** [@pgiorda](https://discuss.elastic.co/u/pgiorda)\ **Replies:** 0\ **Last updated:** [September 19, 2018, 6:32pm UTC](https://discuss.elastic.co/t/dont-understand-wrong-version-number-errors/149177 "2018-09-19T18:32:52Z")
I'm receiving in my logstash output \[2018-09-19T13:21:01,280\]\[INFO \]\[org.logstash.beats.BeatsHandler\] \[local: 0.0.0.0:5044, remote: undefined\] Handling exception: javax.net.ssl.SSLHandshakeException: error:100000f7:SSL … --- ## [Metrics is not executuing in logstash](https://discuss.elastic.co/t/metrics-is-not-executuing-in-logstash/149120)
**Author:** [@KrishnaBrata\_Mondal](https://discuss.elastic.co/u/KrishnaBrata_Mondal)\ **Replies:** 0\ **Last updated:** [September 19, 2018, 11:44am UTC](https://discuss.elastic.co/t/metrics-is-not-executuing-in-logstash/149120 "2018-09-19T11:44:56Z")
Hi All, I am very new in ELK, I have configured the logstash config file where I have below code cnipped configurred to implement and trigger email when a threshold crossed. To get this done I used mertic but its not ex… --- ## [Failed to use SQLite input. \[SQLITE\_ERROR\] SQL error or missing database (no such table: since\_table)](https://discuss.elastic.co/t/failed-to-use-sqlite-input-sqlite-error-sql-error-or-missing-database-no-such-table-since-table/149039)
**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\ **Replies:** 2\ **Last updated:** [September 19, 2018, 2:54pm UTC](https://discuss.elastic.co/t/failed-to-use-sqlite-input-sqlite-error-sql-error-or-missing-database-no-such-table-since-table/149039 "2018-09-19T14:54:45Z")
So I used SQLite input to read my sqlite db. This is my configuration: input { sqlite { path =\> "/home/elk/data/dionaea.sqlite" type =\> dionaea-sqlite } } output { elasticsearch { hosts =\> \["10.33.… --- ## [Performance: is better to deploy on host or on docker containers](https://discuss.elastic.co/t/performance-is-better-to-deploy-on-host-or-on-docker-containers/149123)
**Author:** [@marcellOr](https://discuss.elastic.co/u/marcellOr)\ **Replies:** 2\ **Last updated:** [September 19, 2018, 2:43pm UTC](https://discuss.elastic.co/t/performance-is-better-to-deploy-on-host-or-on-docker-containers/149123 "2018-09-19T14:43:38Z")
Hi all, I'm new to ElasticSearch and I'm starting an analysis for using ElasticSearch both for logging and for data metrics. I know that ES could be deployed using docker and I surely prefer this solution because I pre… --- ## [After adding the config file with the mysql driver, the data is no longer sent to the elastic](https://discuss.elastic.co/t/after-adding-the-config-file-with-the-mysql-driver-the-data-is-no-longer-sent-to-the-elastic/148977)
**Author:** [@Igorr](https://discuss.elastic.co/u/Igorr)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 1:24pm UTC](https://discuss.elastic.co/t/after-adding-the-config-file-with-the-mysql-driver-the-data-is-no-longer-sent-to-the-elastic/148977 "2018-09-19T13:24:22Z")
In the logstash configuration files with PostgreSQL queries already existed. After adding the config file with mysql, after some time the data ceases to arrive in the elastic, tcpdump on the outgoing port also shows the … --- ## [Logstash - counting field entries](https://discuss.elastic.co/t/logstash-counting-field-entries/149111)
**Author:** [@ifishy](https://discuss.elastic.co/u/ifishy)\ **Replies:** 0\ **Last updated:** [September 19, 2018, 11:08am UTC](https://discuss.elastic.co/t/logstash-counting-field-entries/149111 "2018-09-19T11:08:40Z")
Hi, i have built a small filter, that groks a Mac-Adress out of the message of a log. Know, i want to count the entries, how much same mac-adresses in twenty minutes, i tested with "metrics" filter, but i think, i h… --- ## [Duplicate records found](https://discuss.elastic.co/t/duplicate-records-found/149105)
**Author:** [@vschakka](https://discuss.elastic.co/u/vschakka)\ **Replies:** 0\ **Last updated:** [September 19, 2018, 10:51am UTC](https://discuss.elastic.co/t/duplicate-records-found/149105 "2018-09-19T10:51:00Z")
Hi , I received some duplicate records in Elasticsearch, I hope one of the reason is due to time exceeded to send acknowledgement to kafka. But if it is the case, where should i increase it. By the way we are using the … --- ## [Grok filter does not behave as I want it to](https://discuss.elastic.co/t/grok-filter-does-not-behave-as-i-want-it-to/149087)
**Author:** [@antwan](https://discuss.elastic.co/u/antwan)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 10:10am UTC](https://discuss.elastic.co/t/grok-filter-does-not-behave-as-i-want-it-to/149087 "2018-09-19T10:10:37Z")
Hello! I am trying to set up some filters in Logstash, so that my Elastisearch log gets parsed and pretty in Kibana. I have exported the pipeline-plain.json regarding Elasticsearch server log from Filebeat, and after s… --- ## [Bytes calulcation](https://discuss.elastic.co/t/bytes-calulcation/149096)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 0\ **Last updated:** [September 19, 2018, 9:54am UTC](https://discuss.elastic.co/t/bytes-calulcation/149096 "2018-09-19T09:54:53Z")
configuration file: input { file { path =\> "/home/murugar/Documents/denim.csv" type =\> "csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { csv{ separator =\> "," columns =\> \["Index No:… --- ## [Error: undefined method \`path' for nil:NilClass from file input](https://discuss.elastic.co/t/error-undefined-method-path-for-nil-nilclass-from-file-input/148999)
**Author:** [@markus](https://discuss.elastic.co/u/markus)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 7:10am UTC](https://discuss.elastic.co/t/error-undefined-method-path-for-nil-nilclass-from-file-input/148999 "2018-09-19T07:10:17Z")
Hi, I am using logstash 6.4.0 on windows My config looks loke this: input { stdin {} file { path =\> "D:/tmp/xmlTest/\*\*/\*.xml" type =\> "fooBar" mode =\> "read" codec =\> plain { charset =\> "ISO-8859-1" … --- ## [Merge 3 CSV files based on related column](https://discuss.elastic.co/t/merge-3-csv-files-based-on-related-column/148755)
**Author:** [@ravi\_yadav1](https://discuss.elastic.co/u/ravi_yadav1)\ **Replies:** 3\ **Last updated:** [September 19, 2018, 5:07am UTC](https://discuss.elastic.co/t/merge-3-csv-files-based-on-related-column/148755 "2018-09-19T05:07:01Z")
Hi, I am trying to merge 3 csv files which have columns like: 1st CSV: \[oid, symbol, price, qty, side, err1\] 2nd CSV: \[oid, tid, symbol, price, qty, side, err2, error\_msg\] 3rd CSV: \[tid, symbol, price, qty, side, err… --- ## [Running new logstash config without stopping current instance](https://discuss.elastic.co/t/running-new-logstash-config-without-stopping-current-instance/149006)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 2\ **Last updated:** [September 18, 2018, 11:41pm UTC](https://discuss.elastic.co/t/running-new-logstash-config-without-stopping-current-instance/149006 "2018-09-18T23:41:12Z")
I am running logstash with below command ./bin/logstash -f /configfiles --config.reload.automatic & First time I run logstash picks all the config files in the /configfiles folder and start running. After a while(… --- ## [Help with logstash config](https://discuss.elastic.co/t/help-with-logstash-config/148910)
**Author:** [@logstashleaner](https://discuss.elastic.co/u/logstashleaner)\ **Replies:** 3\ **Last updated:** [September 18, 2018, 10:49pm UTC](https://discuss.elastic.co/t/help-with-logstash-config/148910 "2018-09-18T22:49:25Z")
Hello, I need some help in how we can parse logs in the following format. Have been trying using grok and csv but have not been able to parse the logs. Any help will be really helpful. {"ts":"2018-09-17T11:04:14.763",… --- ## [Unknown garbage collector name error](https://discuss.elastic.co/t/unknown-garbage-collector-name-error/149025)
**Author:** [@anuroop](https://discuss.elastic.co/u/anuroop)\ **Replies:** 0\ **Last updated:** [September 18, 2018, 9:10pm UTC](https://discuss.elastic.co/t/unknown-garbage-collector-name-error/149025 "2018-09-18T21:10:31Z")
Hello I am using logstash 6.1.1 I am getting this error in my logstash logs, \[2018-09-18T16:09:14,890\]\[ERROR\]\[logstash.instrument.periodicpoller.jvm\] Unknown garbage collector name {:name=\>nil} Please help Thanks --- ## [Lock held by this virtual machine on lock path](https://discuss.elastic.co/t/lock-held-by-this-virtual-machine-on-lock-path/145804)
**Author:** [@hixian](https://discuss.elastic.co/u/hixian)\ **Replies:** 1\ **Last updated:** [September 18, 2018, 8:59pm UTC](https://discuss.elastic.co/t/lock-held-by-this-virtual-machine-on-lock-path/145804 "2018-09-18T20:59:49Z")
Hi. I have the following error on Logstash: \[2018-08-23T20:07:28,324\]\[DEBUG\]\[logstash.agent \] Executing action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:heartbeat-infinite-analytics} \[2018-08-23T… --- ## [Simple way to test output of data getting written to local Kibana REST endpoint](https://discuss.elastic.co/t/simple-way-to-test-output-of-data-getting-written-to-local-kibana-rest-endpoint/149009)
**Author:** [@dirtyballer3](https://discuss.elastic.co/u/dirtyballer3)\ **Replies:** 1\ **Last updated:** [September 18, 2018, 7:26pm UTC](https://discuss.elastic.co/t/simple-way-to-test-output-of-data-getting-written-to-local-kibana-rest-endpoint/149009 "2018-09-18T19:26:57Z")
I have what i think a simple Docker logstash setup and im trying to troubleshoot why data isnt getting to my endpoint (Kibana)...I am running in debug mode and not seeing any errors so wanted to get some direction on how… --- ## [IPV6 messes up the logstash](https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898)
**Author:** [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)\ **Replies:** 2\ **Last updated:** [September 18, 2018, 5:54pm UTC](https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898 "2018-09-18T17:54:06Z")
I am parsing Microsoft IIS filter logs and some of the logs have IPV4 and some have IPV6. All those logs have IPV6 with scope id are getting output with which is complete messed up. I have tested this in Grok Debugger (i… --- ## [Logstash - Got error as An unknown error occurred sending a bulk request to Elasticsearch](https://discuss.elastic.co/t/logstash-got-error-as-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch/149002)
**Author:** [@Ganesh\_Ram\_Ravi](https://discuss.elastic.co/u/Ganesh_Ram_Ravi)\ **Replies:** 0\ **Last updated:** [September 18, 2018, 3:46pm UTC](https://discuss.elastic.co/t/logstash-got-error-as-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch/149002 "2018-09-18T15:46:04Z")
I am trying to move SQL Server table record to elasticsearch via logstash. Its basically a synchronization. But I am getting an error from LogStash as unknown error. I have provided my configuration file as well as Error… --- ## [Logstash logs duplicates in different indexes despite else if conditions](https://discuss.elastic.co/t/logstash-logs-duplicates-in-different-indexes-despite-else-if-conditions/147810)
**Author:** [@flyingstar16](https://discuss.elastic.co/u/flyingstar16)\ **Replies:** 6\ **Last updated:** [September 18, 2018, 1:48pm UTC](https://discuss.elastic.co/t/logstash-logs-duplicates-in-different-indexes-despite-else-if-conditions/147810 "2018-09-18T13:48:48Z")
Hi, I'm logging Apache logs using the file input, and my Logstash is logging events both to the logstash-yyyy.mm.dd index and the custom one I specify (sometimes also creating duplicates in one of the indexes). Here's … --- ## [How to parser the json object dynamically in logstsh using ruby code](https://discuss.elastic.co/t/how-to-parser-the-json-object-dynamically-in-logstsh-using-ruby-code/146027)
**Author:** [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)\ **Replies:** 4\ **Last updated:** [September 18, 2018, 12:45pm UTC](https://discuss.elastic.co/t/how-to-parser-the-json-object-dynamically-in-logstsh-using-ruby-code/146027 "2018-09-18T12:45:03Z")
I have this as input, I need to parse all the keys and values and put in a sperate event, can you please help me how to achive, Catually I'm only one key and value when I using the below ruby code. "entities": { "PROCE… --- ## [Logstash losing connection to Elasticsearch nodes](https://discuss.elastic.co/t/logstash-losing-connection-to-elasticsearch-nodes/145544)
**Author:** [@Nick\_Peirson](https://discuss.elastic.co/u/Nick_Peirson)\ **Replies:** 4\ **Last updated:** [September 18, 2018, 11:22am UTC](https://discuss.elastic.co/t/logstash-losing-connection-to-elasticsearch-nodes/145544 "2018-09-18T11:22:25Z")
We've got two Logstash nodes that read from redis instances and output to an Elasticsearch cluster. The ES cluster has 8 instances. Three instances store the data on their own servers, three master nodes on their own ser… --- ## [\_dateparsefailure when parsing XML with logstash](https://discuss.elastic.co/t/dateparsefailure-when-parsing-xml-with-logstash/148814)
**Author:** [@drjackal](https://discuss.elastic.co/u/drjackal)\ **Replies:** 4\ **Last updated:** [September 18, 2018, 10:32am UTC](https://discuss.elastic.co/t/dateparsefailure-when-parsing-xml-with-logstash/148814 "2018-09-18T10:32:32Z")
Hi there! I am trying to ingest my DMARC Reports via logstash. I manage to parse the XML, however I fail to get the correct timestamp for the events. An XML example is: \ 0.1 AMAZON-SES pos… --- ## [Use mutate rename filter](https://discuss.elastic.co/t/use-mutate-rename-filter/148626)
**Author:** [@PitoneMaledetto](https://discuss.elastic.co/u/PitoneMaledetto)\ **Replies:** 3\ **Last updated:** [September 18, 2018, 9:59am UTC](https://discuss.elastic.co/t/use-mutate-rename-filter/148626 "2018-09-18T09:59:55Z")
Hi all, I am having some trouble in renaming one of the output field. Please consider (edited for easy reading): \[2018-09-14T13:04:43,936\]\[DEBUG\]\[logstash.pipeline \] filter received {"event"=\>{"@timestamp"=\>201… --- ## [How to convert string type to timestamp](https://discuss.elastic.co/t/how-to-convert-string-type-to-timestamp/148936)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 1\ **Last updated:** [September 18, 2018, 9:36am UTC](https://discuss.elastic.co/t/how-to-convert-string-type-to-timestamp/148936 "2018-09-18T09:36:02Z")
hi there i would like to convert string type to date timestamp i create log\_timestamp field and others below msg by using grok filter eg log\_timestamp : 2018-09-18 14:14:49,036, log\_level : WARN , log\_type: Test Reque… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=682) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=684)