# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=711 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 712 --- ## [Logstash tcp input doesn't work](https://discuss.elastic.co/t/logstash-tcp-input-doesnt-work/142134)
**Author:** [@hbceylan](https://discuss.elastic.co/u/hbceylan)\ **Replies:** 3\ **Last updated:** [July 31, 2018, 11:53am UTC](https://discuss.elastic.co/t/logstash-tcp-input-doesnt-work/142134 "2018-07-31T11:53:00Z")
Hi, I'm using logstash docker like below, but always say "Pipeline has terminated". What's the problem? docker run --name logstash -d -p 4560:4560 -p 4561:4561 --link elasticsearch:elasticsearch -v /opt/logstas… --- ## [Snippet q 2](https://discuss.elastic.co/t/snippet-q-2/141343)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 2\ **Last updated:** [July 31, 2018, 11:35am UTC](https://discuss.elastic.co/t/snippet-q-2/141343 "2018-07-31T11:35:41Z")
input log file : Sep 9 07:50:43 es-rclarke dhclient: bound to 10.10.10.89 -- renewal in 426936 seconds. config file is as follows: filter { grok { match =\> { "message" =\> "%{SYSLOGLINE}" } overwrite =\> \[ "messag… --- ## [Difference between Oracle and Mysql](https://discuss.elastic.co/t/difference-between-oracle-and-mysql/142265)
**Author:** [@seungtae](https://discuss.elastic.co/u/seungtae)\ **Replies:** 1\ **Last updated:** [July 31, 2018, 11:32am UTC](https://discuss.elastic.co/t/difference-between-oracle-and-mysql/142265 "2018-07-31T11:32:59Z")
I think there is a bug in jdbc filter. I use logstash version 6.2.3 I have two Database system, Oracle and Mysql with the same structure. Is Oracle and Mysql query different? In Mysql, jdbc\_streaming { jdbc\_driv… --- ## [2 indices](https://discuss.elastic.co/t/2-indices/142298)
**Author:** [@fooc](https://discuss.elastic.co/u/fooc)\ **Replies:** 6\ **Last updated:** [July 31, 2018, 10:12am UTC](https://discuss.elastic.co/t/2-indices/142298 "2018-07-31T10:12:44Z")
Hello, In my new setup i created a beat.conf so i can receive my data from a windows machine with winlogbeat installed and set the output to elastic. When i create an index i can choose betwen logstash and winlogbeat a… --- ## [Logstash JDBC with Docker not loaded](https://discuss.elastic.co/t/logstash-jdbc-with-docker-not-loaded/142325)
**Author:** [@Ragnar](https://discuss.elastic.co/u/Ragnar)\ **Replies:** 0\ **Last updated:** [July 31, 2018, 9:33am UTC](https://discuss.elastic.co/t/logstash-jdbc-with-docker-not-loaded/142325 "2018-07-31T09:33:18Z")
Build an Elastic stack where I have to connect to a MSSQL Database. So I build my own Logstash image where I import the JDBC driver to the container. FROM docker.elastic.co/logstash/logstash:6.3.0 USER root COPY mssql-j… --- ## [No mapping found for \[@timestamp\]](https://discuss.elastic.co/t/no-mapping-found-for-timestamp/141586)
**Author:** [@gur79](https://discuss.elastic.co/u/gur79)\ **Replies:** 8\ **Last updated:** [July 31, 2018, 8:12am UTC](https://discuss.elastic.co/t/no-mapping-found-for-timestamp/141586 "2018-07-31T08:12:39Z")
I'm real sorry if I'm asking newbie question, i have been introduced to ELK sack last 2 weeks here's my story, i have this internal network of 10 different servers and I'm collecting logs from all of them (using filebea… --- ## [Logstash (http output plugin) to logstash (http inout plugin)](https://discuss.elastic.co/t/logstash-http-output-plugin-to-logstash-http-inout-plugin/142303)
**Author:** [@sakshi\_saxena](https://discuss.elastic.co/u/sakshi_saxena)\ **Replies:** 0\ **Last updated:** [July 31, 2018, 8:02am UTC](https://discuss.elastic.co/t/logstash-http-output-plugin-to-logstash-http-inout-plugin/142303 "2018-07-31T08:02:32Z")
Hi Everyone, I am trying to send logs from one logstash instance to another instance using http output plugin and http input plugin. I am able to to it with following configuration: (Sending Instance) output { http … --- ## [Date filter plugin successfully matches but doesn't show up in Kibana](https://discuss.elastic.co/t/date-filter-plugin-successfully-matches-but-doesnt-show-up-in-kibana/142162)
**Author:** [@arun1](https://discuss.elastic.co/u/arun1)\ **Replies:** 3\ **Last updated:** [July 31, 2018, 6:40am UTC](https://discuss.elastic.co/t/date-filter-plugin-successfully-matches-but-doesnt-show-up-in-kibana/142162 "2018-07-31T06:40:04Z")
Hi All, Here is a snapshot of my logstash config file: The Date filter is able to match the field logtime to the pattern yyyy-MM-dd hh:mm:ss but while creating index I can only see the field @timestamp in the dropdow… --- ## [Multile pattren in single Grok Filter](https://discuss.elastic.co/t/multile-pattren-in-single-grok-filter/142168)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [July 31, 2018, 5:30am UTC](https://discuss.elastic.co/t/multile-pattren-in-single-grok-filter/142168 "2018-07-31T05:30:36Z")
Hello All, I have written multiple pattern in single grok filter, but my logs are parse only first filter. Below are the filter in my Grok match =\> { "message" =\> \[ "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:sy… --- ## [Error: initialize: name or service not known](https://discuss.elastic.co/t/error-initialize-name-or-service-not-known/141357)
**Author:** [@prashansa1](https://discuss.elastic.co/u/prashansa1)\ **Replies:** 4\ **Last updated:** [July 30, 2018, 10:26pm UTC](https://discuss.elastic.co/t/error-initialize-name-or-service-not-known/141357 "2018-07-30T22:26:05Z")
I'm trying to execute logstash script from local to connect with external server. but It is throwing these errors. ERROR logstash.pipeline - A plugin had an unrecoverable error. Will restart this plugin Plugin: \ **Author:** [@designet](https://discuss.elastic.co/u/designet)\ **Replies:** 24\ **Last updated:** [July 30, 2018, 9:51pm UTC](https://discuss.elastic.co/t/denormalize-data-within-a-log-file/141277 "2018-07-30T21:51:50Z") I've got 8000 log files being imported to Logstash via Filebeat. The log files all look something like this: START-OF-LOG: 3.0 LOCATION: DX CALLSIGN: SP1EGN CLUB: SP-CW-C CONTEST: CQ-WW-CW CATEGORY-OPERATOR: SINGLE-OP C… --- ## [Cluster and scheduled pipelines](https://discuss.elastic.co/t/cluster-and-scheduled-pipelines/141897)
**Author:** [@Jasper\_Nygaard](https://discuss.elastic.co/u/Jasper_Nygaard)\ **Replies:** 3\ **Last updated:** [July 30, 2018, 8:26pm UTC](https://discuss.elastic.co/t/cluster-and-scheduled-pipelines/141897 "2018-07-30T20:26:48Z")
Setting up a Logstash cluster to run multiple pipelines. It will be running a number of scheduled JDBC pipelines, besides Beats. But I do not want to have the JDBC pipelines running in parallel, resulting in multiple rec… --- ## [Multiple pipelines and multiple filebeats](https://discuss.elastic.co/t/multiple-pipelines-and-multiple-filebeats/141994)
**Author:** [@HRG](https://discuss.elastic.co/u/HRG)\ **Replies:** 2\ **Last updated:** [July 30, 2018, 8:25pm UTC](https://discuss.elastic.co/t/multiple-pipelines-and-multiple-filebeats/141994 "2018-07-30T20:25:34Z")
Can you please help me below. I have multiple pipelines. each pipleline configuration is receives data from different application servers where we installed filebeat. When i have single pipeline config running(on l… --- ## [How to extract this pattern: limited characters from "00205BKR0000CD"](https://discuss.elastic.co/t/how-to-extract-this-pattern-limited-characters-from-00205bkr0000cd/142240)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 1\ **Last updated:** [July 30, 2018, 7:03pm UTC](https://discuss.elastic.co/t/how-to-extract-this-pattern-limited-characters-from-00205bkr0000cd/142240 "2018-07-30T19:03:17Z")
Hi All I have a event/column in below format Column1 00204VAB0000CD 00204VAB0000CD 00204VAB0000CD 00205BKR0000CD I want to extract in new column like this Column2 VAB VAB VAB BKR This is nothing but the … --- ## [Using grok on just one field](https://discuss.elastic.co/t/using-grok-on-just-one-field/142234)
**Author:** [@CoopTang](https://discuss.elastic.co/u/CoopTang)\ **Replies:** 3\ **Last updated:** [July 30, 2018, 6:40pm UTC](https://discuss.elastic.co/t/using-grok-on-just-one-field/142234 "2018-07-30T18:40:26Z")
So I have been trying to figure out how to use grok on just one field from the input. Specifically, I'm using the beats input to get all my logs, and it automatically produces a bunch of fields for kibana. One of those f… --- ## [Aggregate filter plugin - nested aggregation](https://discuss.elastic.co/t/aggregate-filter-plugin-nested-aggregation/142192)
**Author:** [@NickRbk](https://discuss.elastic.co/u/NickRbk)\ **Replies:** 6\ **Last updated:** [July 30, 2018, 6:35pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-nested-aggregation/142192 "2018-07-30T18:35:46Z")
Hello! I am trying to aggregate some data from DB by Logstash. My data in db looks like this: +----+----------------+---------------------+----------------------+----------------------+ | # | product\_id | product\_na… --- ## [Multiple logs pattern in single grok](https://discuss.elastic.co/t/multiple-logs-pattern-in-single-grok/142205)
**Author:** [@8Bit\_System](https://discuss.elastic.co/u/8Bit_System)\ **Replies:** 3\ **Last updated:** [July 30, 2018, 5:01pm UTC](https://discuss.elastic.co/t/multiple-logs-pattern-in-single-grok/142205 "2018-07-30T17:01:34Z")
Hello Sir i have a single log file which have different diffrent pattern i just want to create a single grok which will work on all pattern please help me in this condation what should i do . #log1 2018-06-14 13:55:5… --- ## [Logstash remove\_field issues](https://discuss.elastic.co/t/logstash-remove-field-issues/142186)
**Author:** [@pastechecker](https://discuss.elastic.co/u/pastechecker)\ **Replies:** 5\ **Last updated:** [July 30, 2018, 4:12pm UTC](https://discuss.elastic.co/t/logstash-remove-field-issues/142186 "2018-07-30T16:12:43Z")
Hello, I am trying to remove some fields from Twitter plugin using Logstash filter. Partial json from Kibana: { "\_index": "twitter", "\_type": "tweets", "\_id": "iedY62QB9sEBYW4Cw1c0", "\_version": 1, "\_score":… --- ## [Logstash Stalling Out on Automatic Config Restart](https://discuss.elastic.co/t/logstash-stalling-out-on-automatic-config-restart/141849)
**Author:** [@kelbymcw](https://discuss.elastic.co/u/kelbymcw)\ **Replies:** 7\ **Last updated:** [July 30, 2018, 3:52pm UTC](https://discuss.elastic.co/t/logstash-stalling-out-on-automatic-config-restart/141849 "2018-07-30T15:52:30Z")
Hello, I've been slamming my head into the desk all day trying to solve this problem. I've set up my logstash to adapt to changes in the config file, but when I change it, it begins to shutdown the pipeline, but stalls, … --- ## [Docker-compose Lostash "Attempted to resurrect connection to dead ES instance, but got an error"](https://discuss.elastic.co/t/docker-compose-lostash-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/142180)
**Author:** [@Ragnar](https://discuss.elastic.co/u/Ragnar)\ **Replies:** 1\ **Last updated:** [July 30, 2018, 3:46pm UTC](https://discuss.elastic.co/t/docker-compose-lostash-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/142180 "2018-07-30T15:46:38Z")
Wanting to build my Elastic stack from docker-compose. Here my file. version: '3.7' services: elasticsearch1: image: docker.elastic.co/elasticsearch/elasticsearch:6.3.2 container\_name: Elasticsearch1 envi… --- ## [Logstash with CSV input](https://discuss.elastic.co/t/logstash-with-csv-input/142044)
**Author:** [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\ **Replies:** 2\ **Last updated:** [July 30, 2018, 3:24pm UTC](https://discuss.elastic.co/t/logstash-with-csv-input/142044 "2018-07-30T15:24:10Z")
Hi, I'm trying to read a CSV file and insert in ES, all in 6.3.2. Should be easy right? I created an index template: PUT \_template/mytemplate { "index\_patterns": \["test\*"\], "settings": { "index.mapping.total\_f… --- ## [The final stage of the event pipeline with an "if" statement](https://discuss.elastic.co/t/the-final-stage-of-the-event-pipeline-with-an-if-statement/142191)
**Author:** [@shog1466112](https://discuss.elastic.co/u/shog1466112)\ **Replies:** 2\ **Last updated:** [July 30, 2018, 3:07pm UTC](https://discuss.elastic.co/t/the-final-stage-of-the-event-pipeline-with-an-if-statement/142191 "2018-07-30T15:07:39Z")
Hi there, I'd like to know if adding a if..else statement to an output section will mean that only events that match the "if" branch will be finalized and sent to the output? I'd like to match only specific events/logs… --- ## [Subtract values for consecutive events](https://discuss.elastic.co/t/subtract-values-for-consecutive-events/142056)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 3\ **Last updated:** [July 30, 2018, 2:56pm UTC](https://discuss.elastic.co/t/subtract-values-for-consecutive-events/142056 "2018-07-30T14:56:44Z")
Hi, A newbie question Version: ES - 5.6.2 Kibana - 5.6.2 Logstash - 5.6.4 I have following data pulled from MySQL database using JDBC input There are multiple meters with unique meter ID. Time … --- ## [How to maintaining My Android Application Logs In Log stash](https://discuss.elastic.co/t/how-to-maintaining-my-android-application-logs-in-log-stash/142202)
**Author:** [@Ramprasath\_Selvam](https://discuss.elastic.co/u/Ramprasath_Selvam)\ **Replies:** 0\ **Last updated:** [July 30, 2018, 2:56pm UTC](https://discuss.elastic.co/t/how-to-maintaining-my-android-application-logs-in-log-stash/142202 "2018-07-30T14:56:25Z")
I'm Developing a one Android application, how to maintaining Logs in Logstash. --- ## [Can't get text on a START\_OBJECT at 1:330](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-330/142131)
**Author:** [@klokkie](https://discuss.elastic.co/u/klokkie)\ **Replies:** 5\ **Last updated:** [July 30, 2018, 2:51pm UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-330/142131 "2018-07-30T14:51:17Z")
Hi I am taking over from a colleague but I don't have any experience yet with logstash and filters (still learning :)) Hopefully someone can help me. Customer is doing this: sends a json message. without tag it is ok… --- ## [Dictionary for my events in Elasticsearch](https://discuss.elastic.co/t/dictionary-for-my-events-in-elasticsearch/142114)
**Author:** [@Sakshi\_Aggarwal](https://discuss.elastic.co/u/Sakshi_Aggarwal)\ **Replies:** 1\ **Last updated:** [July 30, 2018, 1:50pm UTC](https://discuss.elastic.co/t/dictionary-for-my-events-in-elasticsearch/142114 "2018-07-30T13:50:51Z")
Currently I have the following scenario :slight\_smile: I want to dynamically insert a dictionary that replaces the field name , for example, 128 to trade name and similarly others. I have around 400 such fields. So … --- ## [How can i create 2 indexs for to 2 filebeat inputs?](https://discuss.elastic.co/t/how-can-i-create-2-indexs-for-to-2-filebeat-inputs/142178)
**Author:** [@med\_amine](https://discuss.elastic.co/u/med_amine)\ **Replies:** 1\ **Last updated:** [July 30, 2018, 1:37pm UTC](https://discuss.elastic.co/t/how-can-i-create-2-indexs-for-to-2-filebeat-inputs/142178 "2018-07-30T13:37:47Z")
dhnjgdjghghjgh --- ## [Why is my logstash skipping delimiter in dissect mapping?](https://discuss.elastic.co/t/why-is-my-logstash-skipping-delimiter-in-dissect-mapping/142138)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [July 30, 2018, 1:19pm UTC](https://discuss.elastic.co/t/why-is-my-logstash-skipping-delimiter-in-dissect-mapping/142138 "2018-07-30T13:19:14Z")
Hi, I am using GA 6.3.0. I am taking input from Kafka. I have messages like; \ \<\> \<\> \<\> \<\> \ \\\n \ I a… --- ## [Logstash becomes unresponsive](https://discuss.elastic.co/t/logstash-becomes-unresponsive/142181)
**Author:** [@shahrukhkhan](https://discuss.elastic.co/u/shahrukhkhan)\ **Replies:** 0\ **Last updated:** [July 30, 2018, 1:02pm UTC](https://discuss.elastic.co/t/logstash-becomes-unresponsive/142181 "2018-07-30T13:02:37Z")
I am using logstash version 6.1.1. I am currently using it to read multiple files using file input plugin and also runnning scripts though exec plugin and sending the events to elasticsearch. After I start logstash, it w… --- ## [LogStash throwing error 503](https://discuss.elastic.co/t/logstash-throwing-error-503/142163)
**Author:** [@rmanju2020](https://discuss.elastic.co/u/rmanju2020)\ **Replies:** 8\ **Last updated:** [July 30, 2018, 12:57pm UTC](https://discuss.elastic.co/t/logstash-throwing-error-503/142163 "2018-07-30T12:57:15Z")
The Logastash loggers are throwing below errors continuously. "retrying failed action with response code: 503", :level=\>:warn} {:timestamp=\>"2018-07-30T16:58:20.262000+0530", :message=\>"too many attempts at sending eve… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=710) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=712)