# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=712 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 713 --- ## [Delete post](https://discuss.elastic.co/t/delete-post/142112)
**Author:** [@Arjuna](https://discuss.elastic.co/u/Arjuna)\ **Replies:** 0\ **Last updated:** [July 30, 2018, 7:44am UTC](https://discuss.elastic.co/t/delete-post/142112 "2018-07-30T07:44:14Z")
please delete this post --- ## [Office365 Logstash parser](https://discuss.elastic.co/t/office365-logstash-parser/141842)
**Author:** [@a899090](https://discuss.elastic.co/u/a899090)\ **Replies:** 3\ **Last updated:** [July 30, 2018, 11:09am UTC](https://discuss.elastic.co/t/office365-logstash-parser/141842 "2018-07-30T11:09:33Z")
Hi I need some help running this logstash config, when running in ubuntu it keeps on complaining about line 47 where it expected # or =\> but i can't see the problem with the below. Any help will be appreciated. input {… --- ## [Logstash.filters.ruby \] Ruby exception occurred: undefined method \`\[\]' for nil:NilClass](https://discuss.elastic.co/t/logstash-filters-ruby-ruby-exception-occurred-undefined-method-for-nil-nilclass/141873)
**Author:** [@prashansa1](https://discuss.elastic.co/u/prashansa1)\ **Replies:** 1\ **Last updated:** [July 27, 2018, 6:50pm UTC](https://discuss.elastic.co/t/logstash-filters-ruby-ruby-exception-occurred-undefined-method-for-nil-nilclass/141873 "2018-07-27T18:50:01Z")
When I'm writing this code in logstash file(.conf file) and executing, It is giving the value but with exception. filter { ruby { code =\> " k= 0 while k \<= 10 do Test=JSON.parse(response.body)\['hits'\]\['hits'\]\[k\]\['… --- ## [Fetch the value of a variable in logstash file](https://discuss.elastic.co/t/fetch-the-value-of-a-variable-in-logstash-file/142148)
**Author:** [@prashansa1](https://discuss.elastic.co/u/prashansa1)\ **Replies:** 0\ **Last updated:** [July 30, 2018, 10:41am UTC](https://discuss.elastic.co/t/fetch-the-value-of-a-variable-in-logstash-file/142148 "2018-07-30T10:41:22Z")
I'm trying to execute this code inside the filter block of ruby code. filter { ruby { code =\> " test1= Amount test2=2 test3=4 puts key1='map\_' +test1.to\_s + 'RULE' + test2.to\_s + 'RANGE' + test3.to\_s + '\_MIN' " … --- ## [Centos 7 / rsyslog / logstash 6.3.0 - on logstash output always severity code 5 and facility code 1 (2)](https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265)
**Author:** [@pge](https://discuss.elastic.co/u/pge)\ **Replies:** 6\ **Last updated:** [July 30, 2018, 10:06am UTC](https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265 "2018-07-30T10:06:25Z")
Update from previous post: logstash output: always severity code 5 and facility code 1 After some researches I found one interesting discussion about rsyslog and logstash v.5: Support RFC5424 message format Just for … --- ## [Using metadata for MySQL lookups](https://discuss.elastic.co/t/using-metadata-for-mysql-lookups/142121)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 0\ **Last updated:** [July 30, 2018, 8:27am UTC](https://discuss.elastic.co/t/using-metadata-for-mysql-lookups/142121 "2018-07-30T08:27:13Z")
Continuing the discussion from Enriching winlogbeat data with the jdbc\_static filter: I changed my approach and configuration from the previous thread, therefore i created a new thread because i still have the same prob… --- ## [Date field in logstash](https://discuss.elastic.co/t/date-field-in-logstash/141934)
**Author:** [@waitangi](https://discuss.elastic.co/u/waitangi)\ **Replies:** 2\ **Last updated:** [July 30, 2018, 8:10am UTC](https://discuss.elastic.co/t/date-field-in-logstash/141934 "2018-07-30T08:10:46Z")
Hi I use logstash to put my IIS log files to elseicsearch. I use my own grok filter: "message", "%{TIMESTAMP\_ISO8601:request\_timestamp} %{IP:server\_ip} %{WORD:request\_method} %{URIPATH:request\_uri} %{NOTSPACE:request\_q… --- ## [Use multiple codec in one file input ERROR After upgrade to logstash 6.3](https://discuss.elastic.co/t/use-multiple-codec-in-one-file-input-error-after-upgrade-to-logstash-6-3/142116)
**Author:** [@btp2p007](https://discuss.elastic.co/u/btp2p007)\ **Replies:** 1\ **Last updated:** [July 30, 2018, 8:03am UTC](https://discuss.elastic.co/t/use-multiple-codec-in-one-file-input-error-after-upgrade-to-logstash-6-3/142116 "2018-07-30T08:03:34Z")
It is working in the logstash version 5.6 . But not working in 6.3.2 It seems the input can not including two codec parameters . When I delete any one codecs. It is working. How to use both codec in logstash 6.3? ===… --- ## [TCP input plugin and log4j2 socket appender configuration with SSL](https://discuss.elastic.co/t/tcp-input-plugin-and-log4j2-socket-appender-configuration-with-ssl/141891)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 2\ **Last updated:** [July 29, 2018, 6:58am UTC](https://discuss.elastic.co/t/tcp-input-plugin-and-log4j2-socket-appender-configuration-with-ssl/141891 "2018-07-29T06:58:34Z")
Hi There, I am trying to set up a secure communication between tcp input plugin and log4j2 socket appender. I have seen multiple posts with same requests but all have been simple closed with literally no replies. Is th… --- ## [How to Update multiple Elastic search Documents from Logstash Output Plugin](https://discuss.elastic.co/t/how-to-update-multiple-elastic-search-documents-from-logstash-output-plugin/142091)
**Author:** [@Arjun](https://discuss.elastic.co/u/Arjun)\ **Replies:** 0\ **Last updated:** [July 30, 2018, 5:21am UTC](https://discuss.elastic.co/t/how-to-update-multiple-elastic-search-documents-from-logstash-output-plugin/142091 "2018-07-30T05:21:02Z")
My logstash event have a column with array of document IDs to be update - column name :: "listOfDocumentIds". How to iterate over the array and update multiple documents in elastic search. Below is the code I used to u… --- ## [Java log forwarder gets connection refused intermittently](https://discuss.elastic.co/t/java-log-forwarder-gets-connection-refused-intermittently/142086)
**Author:** [@abhai](https://discuss.elastic.co/u/abhai)\ **Replies:** 0\ **Last updated:** [July 30, 2018, 3:48am UTC](https://discuss.elastic.co/t/java-log-forwarder-gets-connection-refused-intermittently/142086 "2018-07-30T03:48:43Z")
Here is my configuration strong text input { tcp { port =\> 5000 type =\> "logs" codec =\> "json\_lines" } } output { elasticsearch { hosts =\> "localhost" } stdout { codec =\> rubydebug } } The input is still ope… --- ## [How to read remote unix logs](https://discuss.elastic.co/t/how-to-read-remote-unix-logs/141470)
**Author:** [@kavitajp](https://discuss.elastic.co/u/kavitajp)\ **Replies:** 8\ **Last updated:** [July 30, 2018, 12:12am UTC](https://discuss.elastic.co/t/how-to-read-remote-unix-logs/141470 "2018-07-30T00:12:11Z")
Hi, i am new to ELK, can someone help me to get logs from remote unix server,i am using filebeat and logstash on my local windows machine. Thanks, --- ## [How Can I extract some fields from existence source in logstash](https://discuss.elastic.co/t/how-can-i-extract-some-fields-from-existence-source-in-logstash/141877)
**Author:** [@Vivek\_Sharma2](https://discuss.elastic.co/u/Vivek_Sharma2)\ **Replies:** 1\ **Last updated:** [July 29, 2018, 8:36pm UTC](https://discuss.elastic.co/t/how-can-i-extract-some-fields-from-existence-source-in-logstash/141877 "2018-07-29T20:36:15Z")
I'm trying to extract some fields from existence json source.I have s3 bucket as a source and elasticsearch as a destination. logstash.config:- input { s3 { bucket =\> "logstash-backup111" access\_key\_id =\> "\*\*\*\*\*\*\*\*\*… --- ## [Logstash is not pushing log to ES when using it as a service through nssm](https://discuss.elastic.co/t/logstash-is-not-pushing-log-to-es-when-using-it-as-a-service-through-nssm/142042)
**Author:** [@HuanW](https://discuss.elastic.co/u/HuanW)\ **Replies:** 2\ **Last updated:** [July 29, 2018, 3:02am UTC](https://discuss.elastic.co/t/logstash-is-not-pushing-log-to-es-when-using-it-as-a-service-through-nssm/142042 "2018-07-29T03:02:39Z")
Hi, I tried with command line as below and it works fine. logstash -f C:\\ELK\\logstash-6.3.0\\bin\\logstash.conf But when I use nssm to make Logstash as a Windows service. logs are not pushing to Elasticsearch anymore. … --- ## [New fields](https://discuss.elastic.co/t/new-fields/141537)
**Author:** [@mohamed.samir](https://discuss.elastic.co/u/mohamed.samir)\ **Replies:** 8\ **Last updated:** [July 29, 2018, 3:44pm UTC](https://discuss.elastic.co/t/new-fields/141537 "2018-07-29T15:44:09Z")
i have forwarded sys log messages to my ELK. i have used grok to filter this logs and abstract the fields, but it didn't work. i am sure with my grok. when i forward the php logs directly to the ELK, with another grok… --- ## [Send logs from log4j2 on cloudhub to logstash on remote redhat linux machine](https://discuss.elastic.co/t/send-logs-from-log4j2-on-cloudhub-to-logstash-on-remote-redhat-linux-machine/140507)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 1\ **Last updated:** [July 29, 2018, 7:04am UTC](https://discuss.elastic.co/t/send-logs-from-log4j2-on-cloudhub-to-logstash-on-remote-redhat-linux-machine/140507 "2018-07-29T07:04:57Z")
Hi There, I am a newbie to ELK stack. As my topic's title crisply says i need to send the logs of an application running on cloudhub to a remote redhat linux machine where my logstash is running (the filter configured f… --- ## [Logstash jdbc for orcle seem to fail](https://discuss.elastic.co/t/logstash-jdbc-for-orcle-seem-to-fail/142031)
**Author:** [@rcstart](https://discuss.elastic.co/u/rcstart)\ **Replies:** 5\ **Last updated:** [July 29, 2018, 3:16am UTC](https://discuss.elastic.co/t/logstash-jdbc-for-orcle-seem-to-fail/142031 "2018-07-29T03:16:29Z")
i use logstash-2.2.0 to sychronize orcle and es,but it seem not to be done ,i have checked the log ,but i can not find an error on it! here is my configTIM%E5%9B%BE%E7%89%8720180728203609|690x108,i try to change the sche… --- ## [Filebeat and Logstash on two Different servers](https://discuss.elastic.co/t/filebeat-and-logstash-on-two-different-servers/142021)
**Author:** [@Priyaranjan\_Mudliar](https://discuss.elastic.co/u/Priyaranjan_Mudliar)\ **Replies:** 2\ **Last updated:** [July 28, 2018, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-on-two-different-servers/142021 "2018-07-28T16:00:19Z")
How do i configure my logstash config file to input from a different beats server(not on localhost). Generally it is this :- input{ beats{ port =\> "5044" } } But now i have beats on a different serve… --- ## [Crop the value of date just to '29/03/2018' ignoring the time](https://discuss.elastic.co/t/crop-the-value-of-date-just-to-29-03-2018-ignoring-the-time/141937)
**Author:** [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\ **Replies:** 4\ **Last updated:** [July 28, 2018, 2:04pm UTC](https://discuss.elastic.co/t/crop-the-value-of-date-just-to-29-03-2018-ignoring-the-time/141937 "2018-07-28T14:04:46Z")
Hi all For a field in CSV "Time Closed" the value is '29/03/2018 09:29' I need to crop the value just to '29/03/2018' ignoring the time so how can i do this using the Date plugin thanks in advance --- ## [How to Install and configure Logstash in Mac](https://discuss.elastic.co/t/how-to-install-and-configure-logstash-in-mac/141743)
**Author:** [@Ramprasath\_Selvam](https://discuss.elastic.co/u/Ramprasath_Selvam)\ **Replies:** 1\ **Last updated:** [July 28, 2018, 11:24am UTC](https://discuss.elastic.co/t/how-to-install-and-configure-logstash-in-mac/141743 "2018-07-28T11:24:24Z")
Install and configure Logstash in Mac system implementation in My iOS Application. thanks in Advance...! --- ## [Upsert not working for same index in Logstash output to ElasticSearch](https://discuss.elastic.co/t/upsert-not-working-for-same-index-in-logstash-output-to-elasticsearch/140559)
**Author:** [@excellent.vivek](https://discuss.elastic.co/u/excellent.vivek)\ **Replies:** 1\ **Last updated:** [July 28, 2018, 9:59am UTC](https://discuss.elastic.co/t/upsert-not-working-for-same-index-in-logstash-output-to-elasticsearch/140559 "2018-07-28T09:59:44Z")
Hi, I am using same index "index =\> "$logstash-%{+YYYY.MM.dd}"" for multiple configuration reading multiple logs so as to have one index for certain type of logs. It only writes index in ElasticSearch for 1st configura… --- ## [Remove some fields from jsion](https://discuss.elastic.co/t/remove-some-fields-from-jsion/141757)
**Author:** [@Vivek\_Sharma2](https://discuss.elastic.co/u/Vivek_Sharma2)\ **Replies:** 6\ **Last updated:** [July 28, 2018, 7:59am UTC](https://discuss.elastic.co/t/remove-some-fields-from-jsion/141757 "2018-07-28T07:59:46Z")
Hi ,I'm trying to read json from s3 and put in Elasticsearch .I put filter in logstash config file.In input I have json, nested json ,list etc. I have to fetch only six fields out of 156 fields how can I put filter? --- ## [Loading IBM DB2 data using Logstash into Elasticsearch](https://discuss.elastic.co/t/loading-ibm-db2-data-using-logstash-into-elasticsearch/142003)
**Author:** [@anon98066099](https://discuss.elastic.co/u/anon98066099)\ **Replies:** 1\ **Last updated:** [July 28, 2018, 3:00am UTC](https://discuss.elastic.co/t/loading-ibm-db2-data-using-logstash-into-elasticsearch/142003 "2018-07-28T03:00:03Z")
Hi, I have 56 views to be loaded into elasticsearch. So i created a config file which has 56 jdbc blocks to load 56 views. Everytime it gets loaded but in Kibana i see only one table randomly. Below is my config file. … --- ## [Grokparsefailure, Geoip lookup failure](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure/141477)
**Author:** [@Adah](https://discuss.elastic.co/u/Adah)\ **Replies:** 11\ **Last updated:** [July 27, 2018, 11:38pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure/141477 "2018-07-27T23:38:38Z")
Hi! I am using ELK 6.2.4 on Ubuntu Centos7. I'm a student doing a project and i am having trouble in getting the geoip :frowning: logstash conf file: i run /usr/share/logstash/bin$ sudo ./logstash -f /etc/logstash/… --- ## [Logstash: cookie file from POST to GET method](https://discuss.elastic.co/t/logstash-cookie-file-from-post-to-get-method/141837)
**Author:** [@m.sereda](https://discuss.elastic.co/u/m.sereda)\ **Replies:** 1\ **Last updated:** [July 27, 2018, 10:05pm UTC](https://discuss.elastic.co/t/logstash-cookie-file-from-post-to-get-method/141837 "2018-07-27T22:05:55Z")
Could you please help me? Here is my logstash.conf and it is working but for this I need to write a cookie manualy. How to login to http://localhost:8080/api/zzzzz/login - make a POST request, get a cookie and than autom… --- ## [IF syntax](https://discuss.elastic.co/t/if-syntax/141852)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [July 27, 2018, 6:55pm UTC](https://discuss.elastic.co/t/if-syntax/141852 "2018-07-27T18:55:38Z")
I seem to be having issues with getting an if statement to function, below are the syntaxs I have tried on 6.2.3 but neither of them have an effect. The event is passing through but it's not getting tagged. I have not … --- ## [How to make automatically renewable login and cookie?](https://discuss.elastic.co/t/how-to-make-automatically-renewable-login-and-cookie/141794)
**Author:** [@m.sereda](https://discuss.elastic.co/u/m.sereda)\ **Replies:** 2\ **Last updated:** [July 27, 2018, 6:53pm UTC](https://discuss.elastic.co/t/how-to-make-automatically-renewable-login-and-cookie/141794 "2018-07-27T18:53:33Z")
Hi, how to make a to make login every 10 minutes automatically? To login my path is "http://localhost:8080/api/ses/login" and I have to enter login and password in a such JSON form { "login": "login", "password": "pass… --- ## [SAP RFC call from Logstash directly](https://discuss.elastic.co/t/sap-rfc-call-from-logstash-directly/141985)
**Author:** [@gagandeep\_singh](https://discuss.elastic.co/u/gagandeep_singh)\ **Replies:** 1\ **Last updated:** [July 27, 2018, 6:47pm UTC](https://discuss.elastic.co/t/sap-rfc-call-from-logstash-directly/141985 "2018-07-27T18:47:29Z")
Can we make an RFC call to SAP application server directly from Logstash? --- ## [Response.code:401](https://discuss.elastic.co/t/response-code-401/141359)
**Author:** [@m.sereda](https://discuss.elastic.co/u/m.sereda)\ **Replies:** 10\ **Last updated:** [July 27, 2018, 6:44pm UTC](https://discuss.elastic.co/t/response-code-401/141359 "2018-07-27T18:44:19Z")
Hi, I am trying to get to the endpoints but getting an error response.code:401. Could anyone explain me how to fix this? --- ## [How to send data from logstash to solr-cloud](https://discuss.elastic.co/t/how-to-send-data-from-logstash-to-solr-cloud/141489)
**Author:** [@prakhara](https://discuss.elastic.co/u/prakhara)\ **Replies:** 1\ **Last updated:** [July 27, 2018, 6:27pm UTC](https://discuss.elastic.co/t/how-to-send-data-from-logstash-to-solr-cloud/141489 "2018-07-27T18:27:10Z")
Hey, I want to ingest my filter output to the solr cloud instance but unable to do so using solr\_http output plugin .Is there is any way else to do so??? [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=711) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=713)