# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=700 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 701 --- ## [I Need help with grok, stuck with grokparsefailure](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725)
**Author:** [@Wuzu85](https://discuss.elastic.co/u/Wuzu85)\ **Replies:** 4\ **Last updated:** [August 17, 2018, 12:27pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725 "2018-08-17T12:27:18Z")
My input file: k10temp-pci-00c3 temp1: +47.8°C (high = +70.0°C) temp1: +48.0°C (crit = +255.0°C) temp1: +47.0°C (crit = +120.0°C, hyst = +90.0°C) k10temp-pci-00c3 Adapter: PCI adapter temp1: … --- ## [Geoip is not working for pfsense](https://discuss.elastic.co/t/geoip-is-not-working-for-pfsense/144731)
**Author:** [@APASCHE](https://discuss.elastic.co/u/APASCHE)\ **Replies:** 1\ **Last updated:** [August 17, 2018, 11:34am UTC](https://discuss.elastic.co/t/geoip-is-not-working-for-pfsense/144731 "2018-08-17T11:34:39Z")
Hello guys, I am new to ELK and I have a single problem node for generating GEOIP information. Need help. Has anyone had the same problem? follows how the logstash configuration looks like I want change the template to… --- ## [Problem using JDBC static filter with HIVE](https://discuss.elastic.co/t/problem-using-jdbc-static-filter-with-hive/144884)
**Author:** [@ilpc](https://discuss.elastic.co/u/ilpc)\ **Replies:** 2\ **Last updated:** [August 17, 2018, 11:04am UTC](https://discuss.elastic.co/t/problem-using-jdbc-static-filter-with-hive/144884 "2018-08-17T11:04:10Z")
I checked and found that the JDBC static filter example with postgreSQL works fine. But when I try HIVE instead of postgreSQL, it says it failed to create database. input { generator { lines =\> \[ '{"from\_ip… --- ## [Set up index for fields created with logstash](https://discuss.elastic.co/t/set-up-index-for-fields-created-with-logstash/144741)
**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\ **Replies:** 1\ **Last updated:** [August 17, 2018, 10:25am UTC](https://discuss.elastic.co/t/set-up-index-for-fields-created-with-logstash/144741 "2018-08-17T10:25:27Z")
Hello, I have a windows server with filebeat who analyzes a log generated by filezilla server. I send to the logstash server in order to add some fields (message, action, user, ...) then I send to elasticsearch. I see… --- ## [Excess data in elasticsearch](https://discuss.elastic.co/t/excess-data-in-elasticsearch/144860)
**Author:** [@Olha1](https://discuss.elastic.co/u/Olha1)\ **Replies:** 3\ **Last updated:** [August 17, 2018, 10:11am UTC](https://discuss.elastic.co/t/excess-data-in-elasticsearch/144860 "2018-08-17T10:11:34Z")
Hi! I have a problem with excess in elasticsearch. When I run logstash with one config file, I have right quantity hits in index. When I have a few config files, which logstash processing, I have the same quantity in eac… --- ## [Logstash pipe input suddenly restarting](https://discuss.elastic.co/t/logstash-pipe-input-suddenly-restarting/144864)
**Author:** [@Lubomir\_Bielik](https://discuss.elastic.co/u/Lubomir_Bielik)\ **Replies:** 1\ **Last updated:** [August 17, 2018, 9:56am UTC](https://discuss.elastic.co/t/logstash-pipe-input-suddenly-restarting/144864 "2018-08-17T09:56:58Z")
Hello, I am using Logstash's pipe input to run another command, for Snort, and collect its output. It was running fine for a few days, so i was developing grok filters for output and so on, but today when I started Logs… --- ## [Use external file to enrich logs in Logstash](https://discuss.elastic.co/t/use-external-file-to-enrich-logs-in-logstash/144836)
**Author:** [@Nayyar\_Coder](https://discuss.elastic.co/u/Nayyar_Coder)\ **Replies:** 2\ **Last updated:** [August 17, 2018, 7:45am UTC](https://discuss.elastic.co/t/use-external-file-to-enrich-logs-in-logstash/144836 "2018-08-17T07:45:02Z")
We have an enrichment file which holds data like this device|IP|Site|Address|Country|Customer|\ We have a standard syslog file Aug 1 14:30:52 \_x.x.x.x\_ 1628986: Aug 1 14:30:52.040 BST: %ILPOWER-5-IE… --- ## [Grok filter not working](https://discuss.elastic.co/t/grok-filter-not-working/144796)
**Author:** [@beato1234](https://discuss.elastic.co/u/beato1234)\ **Replies:** 3\ **Last updated:** [August 17, 2018, 7:42am UTC](https://discuss.elastic.co/t/grok-filter-not-working/144796 "2018-08-17T07:42:36Z")
LogFile \[0808 16:08:51 EAT\] INFO 47260019218176 profile | Start Statistics Info \[vitual server\] = 10.6.2.38:8080 recv called count = 1620 input { file { path =\> "/home/babukuse/data/profile.log.15" start\_… --- ## [JMX plugin, multiple input in one file](https://discuss.elastic.co/t/jmx-plugin-multiple-input-in-one-file/144834)
**Author:** [@kmacew](https://discuss.elastic.co/u/kmacew)\ **Replies:** 0\ **Last updated:** [August 17, 2018, 7:24am UTC](https://discuss.elastic.co/t/jmx-plugin-multiple-input-in-one-file/144834 "2018-08-17T07:24:14Z")
Hi I was wondering if there's possibility to add multiply hosts and jmx points to my jmx logstash config file. Something like that: \[{ "host" : "abc1", "port" : 3502, "alias" : "app1", "queries" : \[ { "object\_nam… --- ## [Why does event.tag inside ruby code throw an error?](https://discuss.elastic.co/t/why-does-event-tag-inside-ruby-code-throw-an-error/144824)
**Author:** [@Amlan\_Das](https://discuss.elastic.co/u/Amlan_Das)\ **Replies:** 2\ **Last updated:** [August 17, 2018, 7:01am UTC](https://discuss.elastic.co/t/why-does-event-tag-inside-ruby-code-throw-an-error/144824 "2018-08-17T07:01:36Z")
trying a simple code to add a ruby filter which adds a tag to the event ruby { code =\> " event.tag("test") " } gives the error : Expected one of #, {, } at line 31, column 20 (byte 473) everything works fine if I… --- ## [Logstash multuline not working](https://discuss.elastic.co/t/logstash-multuline-not-working/144701)
**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\ **Replies:** 6\ **Last updated:** [August 16, 2018, 9:52pm UTC](https://discuss.elastic.co/t/logstash-multuline-not-working/144701 "2018-08-16T21:52:12Z")
Logstash multiline not working. 2018-08-09 04:15:13,307 Closed connection at 8/9/2018 4:15:13 AM -04:00 \<\\> 2018-08-09 04:15:13,307 Unexpected error in time zone update \<\ **Author:** [@chandra0651](https://discuss.elastic.co/u/chandra0651)\ **Replies:** 2\ **Last updated:** [August 16, 2018, 8:27pm UTC](https://discuss.elastic.co/t/assigning-common-fields-with-series-of-process-id/144777 "2018-08-16T20:27:27Z") Hello i have a application where it will generate a process id for each log and one process id will be having 8 different stages of logs.But there is one specific field will be coming as part of 1st stage of log but rema… --- ## [Parsing de logs avec Logstash](https://discuss.elastic.co/t/parsing-de-logs-avec-logstash/144749)
**Author:** [@DOUIRI\_Molka](https://discuss.elastic.co/u/DOUIRI_Molka)\ **Replies:** 1\ **Last updated:** [August 16, 2018, 6:30pm UTC](https://discuss.elastic.co/t/parsing-de-logs-avec-logstash/144749 "2018-08-16T18:30:44Z")
Je rencontre le même problème depuis un certain temps avec losgtash , lors du parsing d'un fichier Log, il bloque au niveau de l'écoute en affichant sur la console : "Logstash successfully started" mais aucun traitement … --- ## [Parsing Logs with Logstash](https://discuss.elastic.co/t/parsing-logs-with-logstash/144704)
**Author:** [@DOUIRI\_Molka](https://discuss.elastic.co/u/DOUIRI_Molka)\ **Replies:** 1\ **Last updated:** [August 16, 2018, 6:17pm UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/144704 "2018-08-16T18:17:42Z")
Je rencontre le même problème depuis un certain temps avec losgtash , lors du parsing d'un fichier Log, il bloque au niveau de l'écoute en affichant sur la console : "Logstash successfully started" mais aucun traitement… --- ## [Error event executor terminated](https://discuss.elastic.co/t/error-event-executor-terminated/144565)
**Author:** [@perryparktung](https://discuss.elastic.co/u/perryparktung)\ **Replies:** 2\ **Last updated:** [August 16, 2018, 5:37pm UTC](https://discuss.elastic.co/t/error-event-executor-terminated/144565 "2018-08-16T17:37:19Z")
Logstash was having pipeline error: event executor terminated. What would possibly be the problem?? Filebeat (v. 6.3.2) - filebeat.yml: filebeat.inputs: - type: log enabled: true paths: - c:\\var\\logs\\oob-demo\\sa… --- ## [Incorrect avro codec output](https://discuss.elastic.co/t/incorrect-avro-codec-output/144450)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 2\ **Last updated:** [August 16, 2018, 5:01pm UTC](https://discuss.elastic.co/t/incorrect-avro-codec-output/144450 "2018-08-16T17:01:47Z")
I have a logstash setup in which the data comes from beats then it will output to elasticsearch and kafka. I used avro codec to both output plugin. Upon checking, the output in elasticsearch is just like a json c0dec a… --- ## [Logstash index don't apear in kibana](https://discuss.elastic.co/t/logstash-index-dont-apear-in-kibana/144371)
**Author:** [@APASCHE](https://discuss.elastic.co/u/APASCHE)\ **Replies:** 6\ **Last updated:** [August 16, 2018, 2:46pm UTC](https://discuss.elastic.co/t/logstash-index-dont-apear-in-kibana/144371 "2018-08-16T14:46:40Z")
dear, I need help with Logstash. I have only one node running kibana elasticsearch and logstash with nginx. The services are UP but the index pattern of logstash does not appear. I looked at the logs and they are normal.… --- ## [Converting bits to bytes](https://discuss.elastic.co/t/converting-bits-to-bytes/144714)
**Author:** [@amakarenkov](https://discuss.elastic.co/u/amakarenkov)\ **Replies:** 2\ **Last updated:** [August 16, 2018, 2:36pm UTC](https://discuss.elastic.co/t/converting-bits-to-bytes/144714 "2018-08-16T14:36:32Z")
Greetings, guys! Here I am with my awfull questions once again! Fast forward to my case: What I am looking is to convert bits to bytes so I can use Kibana standart tools for working with bytes data type. My input to l… --- ## [Pipeline-to-pipeline communication with single input and output](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-with-single-input-and-output/144724)
**Author:** [@hrak](https://discuss.elastic.co/u/hrak)\ **Replies:** 2\ **Last updated:** [August 16, 2018, 1:42pm UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-communication-with-single-input-and-output/144724 "2018-08-16T13:42:47Z")
Imagine the following setup: filebeats --\> logstash concentrator --\> kafka --\> logstash ingest --\> elasticsearch On the 'logstash ingest' side, I am using pipeline-to-pipeline communication to start several pipelines f… --- ## [Parse cloud flare logs in json format with ELK](https://discuss.elastic.co/t/parse-cloud-flare-logs-in-json-format-with-elk/144694)
**Author:** [@Roberto\_Giordani](https://discuss.elastic.co/u/Roberto_Giordani)\ **Replies:** 3\ **Last updated:** [August 16, 2018, 12:08pm UTC](https://discuss.elastic.co/t/parse-cloud-flare-logs-in-json-format-with-elk/144694 "2018-08-16T12:08:09Z")
Hi, I'm trying to create a logstash filter to parse the cloud flare json logs like this {"ClientIP":"x.x.x.x","ClientRequestHost":"www.test.org","ClientRequestMethod":"POST","ClientRequestProtocol":"HTTP/2","ClientRequ… --- ## [JDBC Input Plug In : Read password and username from external file](https://discuss.elastic.co/t/jdbc-input-plug-in-read-password-and-username-from-external-file/142799)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 2\ **Last updated:** [August 2, 2018, 7:15pm UTC](https://discuss.elastic.co/t/jdbc-input-plug-in-read-password-and-username-from-external-file/142799 "2018-08-02T19:15:20Z")
I don't want to write username and password in JDBC input of logstash.conf file but I want to import it from another config file. Can anyone explain if this can be done? I don't want my password/username to be exposed in… --- ## [Jdbc\_password\_filepath](https://discuss.elastic.co/t/jdbc-password-filepath/144680)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 2\ **Last updated:** [August 16, 2018, 11:13am UTC](https://discuss.elastic.co/t/jdbc-password-filepath/144680 "2018-08-16T11:13:45Z")
How to use jdbc\_password\_filepath? It's not clear how it works I don't want my password and username exposed in logstash config file and want a single file where these are stored. So what should jdbc\_user and jdbc\_pa… --- ## [Logstash elasticsearch input plugin logs duplication](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-logs-duplication/144700)
**Author:** [@mevimi](https://discuss.elastic.co/u/mevimi)\ **Replies:** 3\ **Last updated:** [August 16, 2018, 11:12am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-logs-duplication/144700 "2018-08-16T11:12:14Z")
Hi, I use logstash 5.6.8 with the below logstash configuration to forward logs from my elasticsearch to syslog server. I have scheduled the inut plugin to read every minute. I can see same old logs are being read every … --- ## [Running multiple conf files from LS instance with LS 6.x](https://discuss.elastic.co/t/running-multiple-conf-files-from-ls-instance-with-ls-6-x/144379)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 2\ **Last updated:** [August 16, 2018, 11:11am UTC](https://discuss.elastic.co/t/running-multiple-conf-files-from-ls-instance-with-ls-6-x/144379 "2018-08-16T11:11:23Z")
Hi All I have a server with LS 6.x, once i run confile1.conf through command prompt it works perfectly. No issues Once i launch a second conf file , it fails confile2.conf. Exactly same scenario works perfectly in 5.x… --- ## [Logstash-snmptrap collect Cisco-device snmp](https://discuss.elastic.co/t/logstash-snmptrap-collect-cisco-device-snmp/144677)
**Author:** [@jianming](https://discuss.elastic.co/u/jianming)\ **Replies:** 0\ **Last updated:** [August 16, 2018, 9:43am UTC](https://discuss.elastic.co/t/logstash-snmptrap-collect-cisco-device-snmp/144677 "2018-08-16T09:43:15Z")
hi all i want to useing snmptrap collect Cisco-device snmp messages, who can give me some template? thanks. --- ## [Error, cannot retrieve cgroups information undefined method \`\[\]' for nil:NilClass](https://discuss.elastic.co/t/error-cannot-retrieve-cgroups-information-undefined-method-for-nil-nilclass/144675)
**Author:** [@ypkkhatri](https://discuss.elastic.co/u/ypkkhatri)\ **Replies:** 0\ **Last updated:** [August 16, 2018, 9:36am UTC](https://discuss.elastic.co/t/error-cannot-retrieve-cgroups-information-undefined-method-for-nil-nilclass/144675 "2018-08-16T09:36:31Z")
Hi, I'm using logstash to import csv to elasticsearch with specific config file using this command logstash-6.3.2/bin/logstash -f my\_logstash.config --debug but throwing below error: \[2018-08-16T11:20:05,083\]\[DEBUG\]\[lo… --- ## [Logstash snmptrap](https://discuss.elastic.co/t/logstash-snmptrap/144674)
**Author:** [@jianming](https://discuss.elastic.co/u/jianming)\ **Replies:** 0\ **Last updated:** [August 16, 2018, 9:36am UTC](https://discuss.elastic.co/t/logstash-snmptrap/144674 "2018-08-16T09:36:19Z")
hi all: i want to use logstash-snmptrap collect snmp message, i see the logstash'log no say any error, but elasticsearch-head no any index . i use "snmptrap -v 2c -c public 172.32.1.2:1062 '' 1.3.6.1.4.1.8072.… --- ## [RabbitMq Plugin issue](https://discuss.elastic.co/t/rabbitmq-plugin-issue/144088)
**Author:** [@Tigryss](https://discuss.elastic.co/u/Tigryss)\ **Replies:** 4\ **Last updated:** [August 16, 2018, 7:50am UTC](https://discuss.elastic.co/t/rabbitmq-plugin-issue/144088 "2018-08-16T07:50:46Z")
Hi i have an ActiveMQ server which sending me a log4j messages, so I try connect with logstash-input-rabbitmq input { rabbitmq { host =\> "testurl" port =\> 18062 queue =\> "ELK.PLAY.QUEUE" } } \[2018-08-13T06:56:… --- ## [Docs incorrect! - Pipeline-to-Pipeline Communication not working - ConfigurationError](https://discuss.elastic.co/t/docs-incorrect-pipeline-to-pipeline-communication-not-working-configurationerror/144302)
**Author:** [@nniikkoollaaii](https://discuss.elastic.co/u/nniikkoollaaii)\ **Replies:** 3\ **Last updated:** [August 16, 2018, 7:16am UTC](https://discuss.elastic.co/t/docs-incorrect-pipeline-to-pipeline-communication-not-working-configurationerror/144302 "2018-08-16T07:16:46Z")
Hello, I'm trying to get Pipeline-to-Pipeline Communication working according to the distributor pattern in https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html#distributor-pattern (I'm working on… --- ## [Logstash S3 inout plugin crashes when reading Glacier object](https://discuss.elastic.co/t/logstash-s3-inout-plugin-crashes-when-reading-glacier-object/141822)
**Author:** [@Hanciv](https://discuss.elastic.co/u/Hanciv)\ **Replies:** 4\ **Last updated:** [August 16, 2018, 4:33am UTC](https://discuss.elastic.co/t/logstash-s3-inout-plugin-crashes-when-reading-glacier-object/141822 "2018-08-16T04:33:04Z")
Hi, I have configured logstash to read from AWS S3 bucket and send the data to Elastic Search. There is also a lifecycle policy setup in the S3 bucket to archive objects to glaicer after reaching 1 month. When I run log… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=699) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=701)