# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=688 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 689 --- ## [Logstash-filter-verifier working example](https://discuss.elastic.co/t/logstash-filter-verifier-working-example/147911)
**Author:** [@chitraj8](https://discuss.elastic.co/u/chitraj8)\ **Replies:** 1\ **Last updated:** [September 10, 2018, 1:01pm UTC](https://discuss.elastic.co/t/logstash-filter-verifier-working-example/147911 "2018-09-10T13:01:42Z")
I am using logstash 2.4.1 version and went through the readme here https://github.com/magnusbaeck/logstash-filter-verifier Created test.json according to my requirement for application request. Since, I have custom loc… --- ## [Log4j-2 plugin installation error in version 6.2.2](https://discuss.elastic.co/t/log4j-2-plugin-installation-error-in-version-6-2-2/147961)
**Author:** [@ranjeet](https://discuss.elastic.co/u/ranjeet)\ **Replies:** 0\ **Last updated:** [September 10, 2018, 12:37pm UTC](https://discuss.elastic.co/t/log4j-2-plugin-installation-error-in-version-6-2-2/147961 "2018-09-10T12:37:11Z")
Hi, While installing log4j2 plugin getting below error. root@localhost:/home/developers/logstash-5.5.2# bin/logstash-plugin install logstash-input-log4j2 Validating logstash-input-log4j2 Installing logstash-input-log… --- ## [Logstash pipelines remote editing](https://discuss.elastic.co/t/logstash-pipelines-remote-editing/147941)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 3\ **Last updated:** [September 10, 2018, 12:21pm UTC](https://discuss.elastic.co/t/logstash-pipelines-remote-editing/147941 "2018-09-10T12:21:25Z")
I have to develop a elasticsearch management web page. kafka -\> logstash -\> elasticsearch. Here, I need to create the ability to change the logstash configuration on the administration page. it should be able to chang… --- ## [How to apply mutate split on dynamic fields](https://discuss.elastic.co/t/how-to-apply-mutate-split-on-dynamic-fields/147882)
**Author:** [@prakhara](https://discuss.elastic.co/u/prakhara)\ **Replies:** 6\ **Last updated:** [September 10, 2018, 11:56am UTC](https://discuss.elastic.co/t/how-to-apply-mutate-split-on-dynamic-fields/147882 "2018-09-10T11:56:09Z")
How can I apply mutate split on dynamic fields --- ## [Two Elasticsearch outputs, when one ES cluster has issues Logstash stops shipping to both](https://discuss.elastic.co/t/two-elasticsearch-outputs-when-one-es-cluster-has-issues-logstash-stops-shipping-to-both/147915)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 5\ **Last updated:** [September 10, 2018, 11:52am UTC](https://discuss.elastic.co/t/two-elasticsearch-outputs-when-one-es-cluster-has-issues-logstash-stops-shipping-to-both/147915 "2018-09-10T11:52:34Z")
Hello all, I'm working on migrating from Elastic Stack 5.6.X to 6.3.X. So that I would not need to reindex logs from the old cluster tot he new one I thought I would setup a second Elasticsearch output for a few weeks a… --- ## [Logstash cannot run config file on window](https://discuss.elastic.co/t/logstash-cannot-run-config-file-on-window/147922)
**Author:** [@peterch](https://discuss.elastic.co/u/peterch)\ **Replies:** 5\ **Last updated:** [September 10, 2018, 10:12am UTC](https://discuss.elastic.co/t/logstash-cannot-run-config-file-on-window/147922 "2018-09-10T10:12:25Z")
Dear All, I try to run a config file in window but fail. As the log is very long, I attach some of the log. Please advice. 2018-09-10 16:47:45,885 main ERROR Null object returned for RollingFile in Appenders. 2018-09-… --- ## [Error thrown during bulk uploading dataset using Logstash](https://discuss.elastic.co/t/error-thrown-during-bulk-uploading-dataset-using-logstash/147795)
**Author:** [@Rammohan91](https://discuss.elastic.co/u/Rammohan91)\ **Replies:** 6\ **Last updated:** [September 10, 2018, 10:12am UTC](https://discuss.elastic.co/t/error-thrown-during-bulk-uploading-dataset-using-logstash/147795 "2018-09-10T10:12:02Z")
Hi Everyone, I am new to Logstash and have been trying to learn ELK since last couple of days. I am trying to bulk upload a dataset to elasticsearch using logstash, however i am getting below error. Here is the logs t… --- ## [LogStash Json ParserError Unexpected character ('t' (code 116)) : was expecting comma to separate Object entries](https://discuss.elastic.co/t/logstash-json-parsererror-unexpected-character-t-code-116-was-expecting-comma-to-separate-object-entries/147860)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 4\ **Last updated:** [September 10, 2018, 10:09am UTC](https://discuss.elastic.co/t/logstash-json-parsererror-unexpected-character-t-code-116-was-expecting-comma-to-separate-object-entries/147860 "2018-09-10T10:09:55Z")
please Help me please. I want to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf \*.\* action(type="omfwd" target=… --- ## [Jdbc\_static filter with multiple parameters crashes](https://discuss.elastic.co/t/jdbc-static-filter-with-multiple-parameters-crashes/147674)
**Author:** [@JPelastic](https://discuss.elastic.co/u/JPelastic)\ **Replies:** 2\ **Last updated:** [September 10, 2018, 8:55am UTC](https://discuss.elastic.co/t/jdbc-static-filter-with-multiple-parameters-crashes/147674 "2018-09-10T08:55:33Z")
Without the jdbc\_static filter this works fine. input { jdbc { jdbc\_driver\_library =\> "\\trunk\\Installation\\sqljdbc\_6.4\\enu\\mssql-jdbc-6.4.0.jre8.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriv… --- ## [Use centrally managed and local Pipelines together](https://discuss.elastic.co/t/use-centrally-managed-and-local-pipelines-together/147919)
**Author:** [@simioa](https://discuss.elastic.co/u/simioa)\ **Replies:** 0\ **Last updated:** [September 10, 2018, 8:47am UTC](https://discuss.elastic.co/t/use-centrally-managed-and-local-pipelines-together/147919 "2018-09-10T08:47:11Z")
Hi, is it possible to use local defined Pipelines and Managed Pipelines together? In my case, I want to define the Output Pipeline locally, because it is dynamically generated by Puppet. So in case of User or URL Upda… --- ## [How to collect logs from "outside" Hosts?](https://discuss.elastic.co/t/how-to-collect-logs-from-outside-hosts/146325)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 4\ **Last updated:** [September 10, 2018, 8:06am UTC](https://discuss.elastic.co/t/how-to-collect-logs-from-outside-hosts/146325 "2018-09-10T08:06:52Z")
Hi all, Currently I am building a Logging Infrastructure based on ELK. Status Quo I am collecting network logs via Syslog + Logstash Input, Server Logs via Filebeat + Logstash Input (to have the dynamic for custom pros… --- ## [ELK Setup - Hardware Specifications](https://discuss.elastic.co/t/elk-setup-hardware-specifications/147721)
**Author:** [@bardie](https://discuss.elastic.co/u/bardie)\ **Replies:** 3\ **Last updated:** [September 10, 2018, 7:05am UTC](https://discuss.elastic.co/t/elk-setup-hardware-specifications/147721 "2018-09-10T07:05:14Z")
I am currently running a cluster of 5 logstash processors and 3 elasticsearch clusters and i would like to know the minimum amount of memory i would need to be able to process 5000k logs per second --- ## [When using multiple pipelines, problem in startup of one pipeline can stall startup of other unconnected pipelines](https://discuss.elastic.co/t/when-using-multiple-pipelines-problem-in-startup-of-one-pipeline-can-stall-startup-of-other-unconnected-pipelines/147891)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 0\ **Last updated:** [September 10, 2018, 6:36am UTC](https://discuss.elastic.co/t/when-using-multiple-pipelines-problem-in-startup-of-one-pipeline-can-stall-startup-of-other-unconnected-pipelines/147891 "2018-09-10T06:36:42Z")
Hi, We are running v6.4.0 of logstash. Our setup has 2 unconnected pipelines. One pipeline 0\_main handles logs from other hosts (shipped via filebeat) and writes to elasticsearch. The other pipeline 2\_monitor queries lo… --- ## [reason=\>"Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/reason-cant-get-text-on-a-start-object/147829)
**Author:** [@jmassari](https://discuss.elastic.co/u/jmassari)\ **Replies:** 1\ **Last updated:** [September 10, 2018, 6:03am UTC](https://discuss.elastic.co/t/reason-cant-get-text-on-a-start-object/147829 "2018-09-10T06:03:29Z")
Trying to route logs from a local machine to a logstash server in GCP, which then goes to elasticsearch as part of elastic cloud. Looks like this connection is breaking down trying to write to elasticsearch, but that isn… --- ## [How to run multiple conf](https://discuss.elastic.co/t/how-to-run-multiple-conf/147881)
**Author:** [@sureshmcsd](https://discuss.elastic.co/u/sureshmcsd)\ **Replies:** 1\ **Last updated:** [September 10, 2018, 5:10am UTC](https://discuss.elastic.co/t/how-to-run-multiple-conf/147881 "2018-09-10T05:10:20Z")
I want to run multiple conf file. I tried logstash -f 1.conf, 2.conf I tried to run multiple instance of logstash separately Not sure what options can use Sorry for duplicate / re-post. But still no definite answer… --- ## [Multiple index Pattern](https://discuss.elastic.co/t/multiple-index-pattern/147708)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [September 10, 2018, 3:25am UTC](https://discuss.elastic.co/t/multiple-index-pattern/147708 "2018-09-10T03:25:31Z")
Hello Team, I am using ELK6.4.0 and filebeat6.4.0. My architecture is Filebeat-\>Logastash-\>Elasticsearch-\>Kibana. Currently i have 2 index metrcibeat-\* and filebeat-\* on kibana. In metricbeat index i am getting our app… --- ## [Es index name issue coming from Logstash](https://discuss.elastic.co/t/es-index-name-issue-coming-from-logstash/147868)
**Author:** [@prasket](https://discuss.elastic.co/u/prasket)\ **Replies:** 0\ **Last updated:** [September 9, 2018, 9:13pm UTC](https://discuss.elastic.co/t/es-index-name-issue-coming-from-logstash/147868 "2018-09-09T21:13:01Z")
Hello - I am trying to extend my Elastic Stack to include my pfsense logs. Right now Logstash is working with beats setup and I have Filebeat on all my instances. I have added my new inputs for syslog and logs are coming… --- ## [Connection Refused Logstash & Filebeat](https://discuss.elastic.co/t/connection-refused-logstash-filebeat/145794)
**Author:** [@k.m.2013](https://discuss.elastic.co/u/k.m.2013)\ **Replies:** 6\ **Last updated:** [September 9, 2018, 8:39am UTC](https://discuss.elastic.co/t/connection-refused-logstash-filebeat/145794 "2018-09-09T08:39:23Z")
Hello! I am having an error adding a new environment to our ElasticSearch/Redis cluster. This is the error that I am receiving from /var/log/filebeat/filebeat //ERR Failed to connect: dial tcp x.x.x.x:5044: getsockopt… --- ## [Send Logstash JSON to python](https://discuss.elastic.co/t/send-logstash-json-to-python/147758)
**Author:** [@neslog](https://discuss.elastic.co/u/neslog)\ **Replies:** 2\ **Last updated:** [September 8, 2018, 10:30pm UTC](https://discuss.elastic.co/t/send-logstash-json-to-python/147758 "2018-09-08T22:30:12Z")
I'm trying to take the JSON output form Logstash and read it in with Python. Specifically I have the following configuration. WinLogBeat --\> JSON --\> Logstash Beats receiver --\> output to file That all works well. Wh… --- ## [How to dump multiple db tables into EL?](https://discuss.elastic.co/t/how-to-dump-multiple-db-tables-into-el/147622)
**Author:** [@allenyu6](https://discuss.elastic.co/u/allenyu6)\ **Replies:** 3\ **Last updated:** [September 8, 2018, 6:16pm UTC](https://discuss.elastic.co/t/how-to-dump-multiple-db-tables-into-el/147622 "2018-09-08T18:16:52Z")
How to dump multiple db tables into EL? Can you shed a me light? --- ## [AVRO codec output doesn't accept default values](https://discuss.elastic.co/t/avro-codec-output-doesnt-accept-default-values/147815)
**Author:** [@Lieven\_Merckx](https://discuss.elastic.co/u/Lieven_Merckx)\ **Replies:** 0\ **Last updated:** [September 8, 2018, 12:40pm UTC](https://discuss.elastic.co/t/avro-codec-output-doesnt-accept-default-values/147815 "2018-09-08T12:40:42Z")
The flow intended is : file=\> logstash=\> kafka the output should be in AVRO format based on a schema file. { "type": "record", "namespace": "be.limero.log", "name": "LogEvent", "fields": \[ { "name": "schemaVer… --- ## [Jdbc\_streaming filter parameters not working](https://discuss.elastic.co/t/jdbc-streaming-filter-parameters-not-working/147814)
**Author:** [@Muhammed\_Aboobacker](https://discuss.elastic.co/u/Muhammed_Aboobacker)\ **Replies:** 0\ **Last updated:** [September 8, 2018, 12:29pm UTC](https://discuss.elastic.co/t/jdbc-streaming-filter-parameters-not-working/147814 "2018-09-08T12:29:39Z")
Hi I am unable to use jdbc\_streaming filter parameters in the query. jdbc\_streaming { jdbc\_driver\_library =\> "/home/titech/Desktop/jar/mysql-connector-java-5.1.46.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" … --- ## [Convert timestamp with am/pm in field to date](https://discuss.elastic.co/t/convert-timestamp-with-am-pm-in-field-to-date/147804)
**Author:** [@sysdradmin](https://discuss.elastic.co/u/sysdradmin)\ **Replies:** 3\ **Last updated:** [September 8, 2018, 10:44am UTC](https://discuss.elastic.co/t/convert-timestamp-with-am-pm-in-field-to-date/147804 "2018-09-08T10:44:01Z")
Hello, we have a field named 'timestamp' with the format : "12/09/2018 01:02:10 AM" or " 01/05/2018 05:04:01 PM" how to convert it to date format ? i don't know how to delete 'AM' or 'PM' to real time... thks for he… --- ## [KV filter to display null keys](https://discuss.elastic.co/t/kv-filter-to-display-null-keys/147766)
**Author:** [@nilsb](https://discuss.elastic.co/u/nilsb)\ **Replies:** 1\ **Last updated:** [September 7, 2018, 10:23pm UTC](https://discuss.elastic.co/t/kv-filter-to-display-null-keys/147766 "2018-09-07T22:23:56Z")
Hi experts, I am completely new to Logstash and started using logstash 6.4.0 a day before :slight\_smile: Problem statement: I am trying to parse an application log using kv filter. The separator within the log line is… --- ## [How can i catch and store an error in output plugin (Unable to connect database)](https://discuss.elastic.co/t/how-can-i-catch-and-store-an-error-in-output-plugin-unable-to-connect-database/147776)
**Author:** [@jam1142](https://discuss.elastic.co/u/jam1142)\ **Replies:** 0\ **Last updated:** [September 7, 2018, 9:25pm UTC](https://discuss.elastic.co/t/how-can-i-catch-and-store-an-error-in-output-plugin-unable-to-connect-database/147776 "2018-09-07T21:25:16Z")
Hi, I am using JDBC to get data from SQL server, for handling connectivity issues i disabled SQL server and logstash start throwing below error. Does anybody has any idea how can i put condition on this and store error … --- ## [Failed to obtain exclusive access post 6.4.0 upgrade](https://discuss.elastic.co/t/failed-to-obtain-exclusive-access-post-6-4-0-upgrade/147751)
**Author:** [@rreilly-edr](https://discuss.elastic.co/u/rreilly-edr)\ **Replies:** 0\ **Last updated:** [September 7, 2018, 4:55pm UTC](https://discuss.elastic.co/t/failed-to-obtain-exclusive-access-post-6-4-0-upgrade/147751 "2018-09-07T16:55:03Z")
Hi, I upgraded my cluster yesterday along with logstash. I followed the direction about disabling PQ and renabling i did that. I even went as far as deleting the PQ uninstalling and reinstalling. I keep gettin gthis erro… --- ## [Logstash is not acception the data form oracle table](https://discuss.elastic.co/t/logstash-is-not-acception-the-data-form-oracle-table/147743)
**Author:** [@Nirpendra\_Kumar](https://discuss.elastic.co/u/Nirpendra_Kumar)\ **Replies:** 0\ **Last updated:** [September 7, 2018, 3:39pm UTC](https://discuss.elastic.co/t/logstash-is-not-acception-the-data-form-oracle-table/147743 "2018-09-07T15:39:34Z")
Hi , I configured logstash with jdbc and I am getting data from all columns except one which has muliple values separated with spaces and commans . How to make this working I am getting the below error. /OutputStrateg… --- ## [Error sending message to elastic via logstash (Can't get text on a START\_OBJECT)](https://discuss.elastic.co/t/error-sending-message-to-elastic-via-logstash-cant-get-text-on-a-start-object/147742)
**Author:** [@Michel\_Albert](https://discuss.elastic.co/u/Michel_Albert)\ **Replies:** 0\ **Last updated:** [September 7, 2018, 3:22pm UTC](https://discuss.elastic.co/t/error-sending-message-to-elastic-via-logstash-cant-get-text-on-a-start-object/147742 "2018-09-07T15:22:56Z")
I'm currently trying to add specific fields (which are defined in internal logging guidelines) to a log message. These fields are namespaced and look (in JSON) something like this: { ... "message": "Hello World!… --- ## [How can I check index exists in logstash filter and how can get dynamic field from elasticsearch lookup( in filter plugin)](https://discuss.elastic.co/t/how-can-i-check-index-exists-in-logstash-filter-and-how-can-get-dynamic-field-from-elasticsearch-lookup-in-filter-plugin/147616)
**Author:** [@jam1142](https://discuss.elastic.co/u/jam1142)\ **Replies:** 0\ **Last updated:** [September 6, 2018, 5:25pm UTC](https://discuss.elastic.co/t/how-can-i-check-index-exists-in-logstash-filter-and-how-can-get-dynamic-field-from-elasticsearch-lookup-in-filter-plugin/147616 "2018-09-06T17:25:07Z")
Q1: How can i check index exists in "Elasticsearch filter plugin". My situation is taht i am getting old data from elasticsearch to subtract from current record but in case if that index doesn't exist then i want to sub… --- ## [Can i add suggest array for autosuggestion with in logsatash](https://discuss.elastic.co/t/can-i-add-suggest-array-for-autosuggestion-with-in-logsatash/147687)
**Author:** [@chitresh\_jain](https://discuss.elastic.co/u/chitresh_jain)\ **Replies:** 0\ **Last updated:** [September 7, 2018, 9:48am UTC](https://discuss.elastic.co/t/can-i-add-suggest-array-for-autosuggestion-with-in-logsatash/147687 "2018-09-07T09:48:59Z")
Hello, could someone please tell me if I can add the suggest array using logstash which initially I used to add using curl -X PUT "localhost:9200/assessment\_kit/\_doc/1?refresh" -H "Content-Type:application/json" -d { "su… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=687) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=689)