# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=710 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 711 --- ## [Multiple TCP output plugins in Logstash](https://discuss.elastic.co/t/multiple-tcp-output-plugins-in-logstash/142437)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 2\ **Last updated:** [August 1, 2018, 1:23pm UTC](https://discuss.elastic.co/t/multiple-tcp-output-plugins-in-logstash/142437 "2018-08-01T13:23:34Z")
Hi, I am planning to send logs to 2 different servers over TCP. My output section looks looks something like, output { tcp { host =\> "XX.X.XXX.XXX" #ip address of server 1 mode =\> "… --- ## [Logstash || Insert Apache log file to Oracle Database](https://discuss.elastic.co/t/logstash-insert-apache-log-file-to-oracle-database/142560)
**Author:** [@ssneha02](https://discuss.elastic.co/u/ssneha02)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 12:36pm UTC](https://discuss.elastic.co/t/logstash-insert-apache-log-file-to-oracle-database/142560 "2018-08-01T12:36:36Z")
I am trying to insert my daily Apache logs to Oracle database. I did the following configuration file coding, however I am getting error - Couldn't find any output plugin. I have done testing on 6.3.2 & 5.6.0 versions of… --- ## [Grok patern for Cloudfront logs not work](https://discuss.elastic.co/t/grok-patern-for-cloudfront-logs-not-work/140137)
**Author:** [@mobil1](https://discuss.elastic.co/u/mobil1)\ **Replies:** 13\ **Last updated:** [August 1, 2018, 12:20pm UTC](https://discuss.elastic.co/t/grok-patern-for-cloudfront-logs-not-work/140137 "2018-08-01T12:20:53Z")
Hello all, can anybody help my ? I am use this grok pattern for cloudfont logs "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}%{SPACE}%{TIME:time}%{SPACE}(?\\\b\\w+\\b)%{SPACE}(?:%{NUMBER:sc\_bytes}|-)%{SPA… --- ## [GROK not able to read errors](https://discuss.elastic.co/t/grok-not-able-to-read-errors/142547)
**Author:** [@rohit02bits](https://discuss.elastic.co/u/rohit02bits)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 12:17pm UTC](https://discuss.elastic.co/t/grok-not-able-to-read-errors/142547 "2018-08-01T12:17:47Z")
I amusing the following grok in my logstash config filter{ grok{ match =\> { "message" =\> \[ "%{TIMESTAMP\_ISO8601:log\_date} \[%{NOTSPACE:thread}\] %{LOGLEVEL:log\_level} %{NOTSPACE:classname} - EventID:%{NOTSPACE:eventID},… --- ## [Logstash base64 encode/decode from jdbc into Elastic does not generate same results](https://discuss.elastic.co/t/logstash-base64-encode-decode-from-jdbc-into-elastic-does-not-generate-same-results/142548)
**Author:** [@fcoll](https://discuss.elastic.co/u/fcoll)\ **Replies:** 0\ **Last updated:** [August 1, 2018, 11:11am UTC](https://discuss.elastic.co/t/logstash-base64-encode-decode-from-jdbc-into-elastic-does-not-generate-same-results/142548 "2018-08-01T11:11:49Z")
Hi, I am trying to ingest BLOB data using jdbc input plugin into Elastic. I use a Base64 encoder filter to before ingesting into Elastic and viceversa when reading. Both logstash configurations (from Oracle-\>logststash… --- ## [Logstash throwing error while index data into elastic search](https://discuss.elastic.co/t/logstash-throwing-error-while-index-data-into-elastic-search/142496)
**Author:** [@Sudeendra\_G](https://discuss.elastic.co/u/Sudeendra_G)\ **Replies:** 3\ **Last updated:** [August 1, 2018, 10:59am UTC](https://discuss.elastic.co/t/logstash-throwing-error-while-index-data-into-elastic-search/142496 "2018-08-01T10:59:57Z")
Hello , I got following exception while index data into Elasticsearch using logstash Could not index event to elasticsearch error"=\>{"type"=\>"strict\_dynamic\_mapping\_exception", "reason"=\>"mapping set to strict, dynami… --- ## [Concatenate all fields of an event to message field?](https://discuss.elastic.co/t/concatenate-all-fields-of-an-event-to-message-field/142541)
**Author:** [@Pierre\_ALLYNDREE](https://discuss.elastic.co/u/Pierre_ALLYNDREE)\ **Replies:** 0\ **Last updated:** [August 1, 2018, 10:45am UTC](https://discuss.elastic.co/t/concatenate-all-fields-of-an-event-to-message-field/142541 "2018-08-01T10:45:49Z")
Hello, We are using the JDBC plugin to get some rows from a table. That works, and I can see some input event retrieved from the ORACLE database. I would want to concatenate all the fields of the returned database row… --- ## [MySQL floats get approximate values](https://discuss.elastic.co/t/mysql-floats-get-approximate-values/141730)
**Author:** [@Jevgenij](https://discuss.elastic.co/u/Jevgenij)\ **Replies:** 4\ **Last updated:** [August 1, 2018, 10:21am UTC](https://discuss.elastic.co/t/mysql-floats-get-approximate-values/141730 "2018-08-01T10:21:00Z")
MySQL fields of float type ain't passed to Elasticsearch with its exact values. 10.95 for instance transforms to 10.949999809265137. Not a big difference, but becomes a problem while filtering against equal condition. … --- ## [My error Any Suggestion](https://discuss.elastic.co/t/my-error-any-suggestion/142516)
**Author:** [@lalitnandandiwakar](https://discuss.elastic.co/u/lalitnandandiwakar)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 9:39am UTC](https://discuss.elastic.co/t/my-error-any-suggestion/142516 "2018-08-01T09:39:44Z")
\[2018-08-01T06:51:39,864\]\[ERROR\]\[logstash.pipeline\]Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"#\ **Author:** [@bobbytan](https://discuss.elastic.co/u/bobbytan)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 9:21am UTC](https://discuss.elastic.co/t/changing-field-type-of-parsed-xml/142481 "2018-08-01T09:21:38Z") Hello, I have used an xml filter plugin to parse for fields from an xml file.The data type of these fields are parsed as strings,is it possible to parse numeric values as integers? Have tried using mutate filter listed… --- ## [Ruby : Remove event](https://discuss.elastic.co/t/ruby-remove-event/142479)
**Author:** [@Pierre2](https://discuss.elastic.co/u/Pierre2)\ **Replies:** 2\ **Last updated:** [August 1, 2018, 8:48am UTC](https://discuss.elastic.co/t/ruby-remove-event/142479 "2018-08-01T08:48:41Z")
Hello ! I know that it is possible to remove fields from one event thanks to "event.remove('field')". I want to know if there is a way to remove the complete event and not one or two fields. My probleme is that I have… --- ## [Parsing field on conf file](https://discuss.elastic.co/t/parsing-field-on-conf-file/141923)
**Author:** [@jagan](https://discuss.elastic.co/u/jagan)\ **Replies:** 4\ **Last updated:** [August 1, 2018, 8:20am UTC](https://discuss.elastic.co/t/parsing-field-on-conf-file/141923 "2018-08-01T08:20:22Z")
Hi Mate, Could you please suggest me how do i parse my field (i.e age) which has value as \[0-10)\[10-20)....While parsing my fields how do i do in my conf file ?(by default logstash takes every field as string ). Thank… --- ## [Logging To Slack with escaped JSON strings](https://discuss.elastic.co/t/logging-to-slack-with-escaped-json-strings/142500)
**Author:** [@r0bnet](https://discuss.elastic.co/u/r0bnet)\ **Replies:** 0\ **Last updated:** [August 1, 2018, 8:02am UTC](https://discuss.elastic.co/t/logging-to-slack-with-escaped-json-strings/142500 "2018-08-01T08:02:36Z")
Hey, i'm receiving loggin events as json via UDP in Logstash and want to send them to Slack if certain conditions are met. Problem is that the Slack Plugin converts the fields to json strings which fails if there are so… --- ## [Logstash logic to filter jenkins json metrics](https://discuss.elastic.co/t/logstash-logic-to-filter-jenkins-json-metrics/142487)
**Author:** [@rosenrot](https://discuss.elastic.co/u/rosenrot)\ **Replies:** 0\ **Last updated:** [August 1, 2018, 7:25am UTC](https://discuss.elastic.co/t/logstash-logic-to-filter-jenkins-json-metrics/142487 "2018-08-01T07:25:55Z")
I want to filter and send jenkins metrics timer data in my logstash conf file. Can someone help me with what should i write in the filter block. So far my logstash conf file contains the below code I want get all the … --- ## [Kv filter doubts](https://discuss.elastic.co/t/kv-filter-doubts/136846)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 34\ **Last updated:** [August 1, 2018, 6:03am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846 "2018-08-01T06:03:15Z")
Upon filtering the fields in kvs, can if or any other conditional statemnts be used on the keys and values. If so, how? --- ## [How to parse space with xpath in logstash](https://discuss.elastic.co/t/how-to-parse-space-with-xpath-in-logstash/142465)
**Author:** [@Aristarkh\_Bushkov](https://discuss.elastic.co/u/Aristarkh_Bushkov)\ **Replies:** 0\ **Last updated:** [August 1, 2018, 5:32am UTC](https://discuss.elastic.co/t/how-to-parse-space-with-xpath-in-logstash/142465 "2018-08-01T05:32:30Z")
Hi everyone. I try to parse space with xpath in logstash. My code works, but when this condition "///Sql\_Text\[text()\[contains(.,'DROP'' '') or contains(.,'CREATE'\\s'') see CREATED or DROPED it take it and i need to add s… --- ## [Logstash Unable to Load Library 6.3.2](https://discuss.elastic.co/t/logstash-unable-to-load-library-6-3-2/142450)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [July 31, 2018, 10:50pm UTC](https://discuss.elastic.co/t/logstash-unable-to-load-library-6-3-2/142450 "2018-07-31T22:50:39Z")
I turned on trace logging which I haven't done for a few versions and the below error displays after pipelines load and connectivity with Elasticsearch is established. Everything appears to be running fine, just curious… --- ## [Date filter help](https://discuss.elastic.co/t/date-filter-help/142433)
**Author:** [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\ **Replies:** 1\ **Last updated:** [July 31, 2018, 9:17pm UTC](https://discuss.elastic.co/t/date-filter-help/142433 "2018-07-31T21:17:39Z")
Hello i am wondering to parse this date in logstash filter July 31st 2018, 09:28:01.000 but i am not able to find the way to match the st part. can anyone give me help? --- ## [Logstash Docker container is not working with the config file which worked fine in windows](https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397)
**Author:** [@sreeja](https://discuss.elastic.co/u/sreeja)\ **Replies:** 2\ **Last updated:** [July 31, 2018, 7:25pm UTC](https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397 "2018-07-31T19:25:10Z")
Hi, I was using logstash in my Windows machine, and it was working fine. Now my server is in Linux and I am using logstash docker container. Most of the things which worked in windows is not working now, the regex patte… --- ## [LogStash Pipeline Behavior](https://discuss.elastic.co/t/logstash-pipeline-behavior/142422)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [July 31, 2018, 5:22pm UTC](https://discuss.elastic.co/t/logstash-pipeline-behavior/142422 "2018-07-31T17:22:38Z")
Looking through SOF-ELK's config files, I'm curious as to how the pipeline works on this implementation. SOF-ELK contains a few dozen pipeline config files, but they're in stages, none of them contain a full input-\>filt… --- ## [Kibana all time \_dateparsefailure](https://discuss.elastic.co/t/kibana-all-time-dateparsefailure/142404)
**Author:** [@satana](https://discuss.elastic.co/u/satana)\ **Replies:** 4\ **Last updated:** [July 31, 2018, 4:31pm UTC](https://discuss.elastic.co/t/kibana-all-time-dateparsefailure/142404 "2018-07-31T16:31:16Z")
Hello. I Have \_dateparsefailure in Kibana, but in logstash, I think, it's ok Can you help my ? echo "gmail.video.google.com;10.111.13.232;31/Jul/2018:17:11:59 +0300;200;0.006;13820;GET /online/js/final.css?v=22e0aff8ds… --- ## [Combining Multiple Records in Logstash](https://discuss.elastic.co/t/combining-multiple-records-in-logstash/142378)
**Author:** [@Jack\_McAleese](https://discuss.elastic.co/u/Jack_McAleese)\ **Replies:** 5\ **Last updated:** [July 31, 2018, 3:28pm UTC](https://discuss.elastic.co/t/combining-multiple-records-in-logstash/142378 "2018-07-31T15:28:04Z")
I am working on ingesting pricing logs. A sample of the data I am ingesting looks like this: D|535|00846U101|256||100|0.0001 1 0.01 B|1|1523318400.0108|62.28|1|72.21|1|0|k||200000005449000 B|2|1523318400.0245|62.28|1|… --- ## [Logstash logs :sql\_last\_value in local timezone, making fresh db records lookup unfeasible](https://discuss.elastic.co/t/logstash-logs-sql-last-value-in-local-timezone-making-fresh-db-records-lookup-unfeasible/140597)
**Author:** [@Jevgenij](https://discuss.elastic.co/u/Jevgenij)\ **Replies:** 8\ **Last updated:** [July 31, 2018, 3:16pm UTC](https://discuss.elastic.co/t/logstash-logs-sql-last-value-in-local-timezone-making-fresh-db-records-lookup-unfeasible/140597 "2018-07-31T15:16:30Z")
Hello! My goal is to set up continuous data migration from MySQL to Elasticsearch. I've got stuck with :sql\_last\_value. Logstash logs it in local timezone, so next time it queries db, :sql\_last\_value value is wrong. M… --- ## [Logstash grok extract error messages from nifi logs](https://discuss.elastic.co/t/logstash-grok-extract-error-messages-from-nifi-logs/142251)
**Author:** [@databeata](https://discuss.elastic.co/u/databeata)\ **Replies:** 3\ **Last updated:** [July 31, 2018, 2:59pm UTC](https://discuss.elastic.co/t/logstash-grok-extract-error-messages-from-nifi-logs/142251 "2018-07-31T14:59:36Z")
How do I extract error messages from nifi logs? log 1: 2018-07-30 18:43:32,656 ERROR \[Timer-Driven Process Thread-8\] o.a.n.p.a.storage.ListAzureBlobStorage ListAzureBlobStorage\[id=1c111111-0164-1000-ca9e-6d37fd307870\] … --- ## [Parsing a lot of different syslogs using logstash](https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324)
**Author:** [@Kateryna](https://discuss.elastic.co/u/Kateryna)\ **Replies:** 6\ **Last updated:** [July 31, 2018, 2:24pm UTC](https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324 "2018-07-31T14:24:50Z")
Hi guys! I have to parse a lot of different syslogs. Here are a few examples: 07/31/2018:08:45:02 GMT res-nsvpx-pri 0-PPE-0 : default SSLLOG SSL\_HANDSHAKE\_SUCCESS 15132959 0 : SPCBId 483501867 - ClientIP 40.115.27.19… --- ## [LogStash priniting errors](https://discuss.elastic.co/t/logstash-priniting-errors/142310)
**Author:** [@shankar123](https://discuss.elastic.co/u/shankar123)\ **Replies:** 1\ **Last updated:** [July 31, 2018, 1:53pm UTC](https://discuss.elastic.co/t/logstash-priniting-errors/142310 "2018-07-31T13:53:09Z")
The log-stash is printing continuous errors retrying failed action with response code: 503", :level=\>:warn} {:timestamp=\>"2018-07-31T12:57:21.076000+0530", :message=\>"Got error to send bulk of actions: blocked by: \[SER… --- ## [Postman data into http\_poller method](https://discuss.elastic.co/t/postman-data-into-http-poller-method/141690)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 8\ **Last updated:** [July 31, 2018, 1:35pm UTC](https://discuss.elastic.co/t/postman-data-into-http-poller-method/141690 "2018-07-31T13:35:59Z")
Hi all, We are working on fetching data from a monitoring tool into elastic search, the integration is possible through postman wherein i'll pass user credentials and a service tag to get the output. Is there a way in … --- ## [Grok filter Mappings ignored by logstash](https://discuss.elastic.co/t/grok-filter-mappings-ignored-by-logstash/142295)
**Author:** [@Md.Khan](https://discuss.elastic.co/u/Md.Khan)\ **Replies:** 3\ **Last updated:** [July 31, 2018, 1:31pm UTC](https://discuss.elastic.co/t/grok-filter-mappings-ignored-by-logstash/142295 "2018-07-31T13:31:29Z")
we have created below grok filter for mapping the log fields, but still logstash is using default mapping when pipeline initiated. // filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} +%{LOGLEVE… --- ## [A lack in the logstash documentation?](https://discuss.elastic.co/t/a-lack-in-the-logstash-documentation/142353)
**Author:** [@michaelprem](https://discuss.elastic.co/u/michaelprem)\ **Replies:** 1\ **Last updated:** [July 31, 2018, 12:39pm UTC](https://discuss.elastic.co/t/a-lack-in-the-logstash-documentation/142353 "2018-07-31T12:39:55Z")
Hello! I am new to logstash, and was trying to process some XML records that I have in a database, a record in each cell. (the goal is indexing them in elasticsearch.) The xml filter plugin was an obvious choice, with… --- ## [Logstash cron schedule to run every 12 hours starting at certain time](https://discuss.elastic.co/t/logstash-cron-schedule-to-run-every-12-hours-starting-at-certain-time/142356)
**Author:** [@abhisheksimion](https://discuss.elastic.co/u/abhisheksimion)\ **Replies:** 3\ **Last updated:** [July 31, 2018, 12:16pm UTC](https://discuss.elastic.co/t/logstash-cron-schedule-to-run-every-12-hours-starting-at-certain-time/142356 "2018-07-31T12:16:31Z")
I am trying 0 1/12 \* \* \* cron expression but it only fires once a day. Below is 1 of my configuration. input { jdbc { jdbc\_connection\_string =\> "jdbc:redshift://xxx.us-west-2.redshift.amazonaws.com:5439/xxx" jdbc\_u… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=709) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=711)