# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=715 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 716 --- ## [Issue in Logstash installation on Windows](https://discuss.elastic.co/t/issue-in-logstash-installation-on-windows/136852)
**Author:** [@Shweta\_Priyadarshani](https://discuss.elastic.co/u/Shweta_Priyadarshani)\ **Replies:** 7\ **Last updated:** [July 25, 2018, 12:47pm UTC](https://discuss.elastic.co/t/issue-in-logstash-installation-on-windows/136852 "2018-07-25T12:47:44Z")
Hello all, I am completely new to logstash. I began with downloading logstash for windows zip file, unzipped it in d drive. Now i am trying to cmd D:\\logstash-6.3.0\\bin\>logstash. Its giving me following error: Sending … --- ## [Logstash- issue to parse logs from multi location](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510)
**Author:** [@2anilkumar](https://discuss.elastic.co/u/2anilkumar)\ **Replies:** 3\ **Last updated:** [July 25, 2018, 12:00pm UTC](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510 "2018-07-25T12:00:28Z")
\--------- filebeat.yml ------ filebeat.prospectors: type: log Change to true to enable this prospector configuration. enabled: true paths: /root/airflow/logs/scheduler//.log fields: {log\_type: airflow\_dags\_log} … --- ## [Using logstash, How to filter Errors only from logs?](https://discuss.elastic.co/t/using-logstash-how-to-filter-errors-only-from-logs/43234)
**Author:** [@devalkars](https://discuss.elastic.co/u/devalkars)\ **Replies:** 9\ **Last updated:** [July 25, 2018, 11:56am UTC](https://discuss.elastic.co/t/using-logstash-how-to-filter-errors-only-from-logs/43234 "2018-07-25T11:56:22Z")
Hi, I am using logstash in our project, How to filter Errors only from logs ? i am using below configuration: input { file { path =\> "D:/apache-tomcat-7.0.67/logs/cpe.log" start\_position =\> "beginning" … --- ## [How to start logstash 6.2.4 multiple instance](https://discuss.elastic.co/t/how-to-start-logstash-6-2-4-multiple-instance/139728)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 6\ **Last updated:** [July 25, 2018, 11:40am UTC](https://discuss.elastic.co/t/how-to-start-logstash-6-2-4-multiple-instance/139728 "2018-07-25T11:40:52Z")
Hi , How can i run multiple logstash configuration file on single server ? When i am running more than one configuration file i am getting error message for multiple instance running. Thanks, Priti --- ## [Logstash update document to elasticsearch problem](https://discuss.elastic.co/t/logstash-update-document-to-elasticsearch-problem/141550)
**Author:** [@ivancororo](https://discuss.elastic.co/u/ivancororo)\ **Replies:** 0\ **Last updated:** [July 25, 2018, 11:31am UTC](https://discuss.elastic.co/t/logstash-update-document-to-elasticsearch-problem/141550 "2018-07-25T11:31:47Z")
Hello, first of all, sorry for my English. I hope you understand me. I´m new in ELK and I have a problem when I try to update document from logstash to elasticsearch. In my log file, I receive a line with a date of sta… --- ## [Grok filter failing multiline logs from filebeat](https://discuss.elastic.co/t/grok-filter-failing-multiline-logs-from-filebeat/141152)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 1\ **Last updated:** [July 25, 2018, 10:03am UTC](https://discuss.elastic.co/t/grok-filter-failing-multiline-logs-from-filebeat/141152 "2018-07-25T10:03:53Z")
Hello, I have problem with parsing multiline log messages from Filebeat to Logstash using grok filter. This is my configuration of filebeat.yml: filebeat.inputs: - type: log paths: - "/home/mladen/De… --- ## [Logstash translate plugin example leads to error](https://discuss.elastic.co/t/logstash-translate-plugin-example-leads-to-error/141444)
**Author:** [@Harsh\_Karn](https://discuss.elastic.co/u/Harsh_Karn)\ **Replies:** 1\ **Last updated:** [July 25, 2018, 9:48am UTC](https://discuss.elastic.co/t/logstash-translate-plugin-example-leads-to-error/141444 "2018-07-25T09:48:47Z")
The example given for dictionary field for logstash translate plugin is incorrect and when used causes logstash error. In the example for dictionary field in translate plugin documentation, there should be no commas. Fo… --- ## [Sql\_last\_value getting reset](https://discuss.elastic.co/t/sql-last-value-getting-reset/141478)
**Author:** [@Sunil\_Khullar](https://discuss.elastic.co/u/Sunil_Khullar)\ **Replies:** 2\ **Last updated:** [July 25, 2018, 9:16am UTC](https://discuss.elastic.co/t/sql-last-value-getting-reset/141478 "2018-07-25T09:16:32Z")
It seems the variable sql\_last\_value gets reset everytime we restart logstash, instead of reading from the value stored in the file defined in last\_run\_metadata\_path is this the correct behavior? or is something wrong? … --- ## [\_grokparsefailure exception from logstash while stashing events](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 5\ **Last updated:** [July 25, 2018, 9:06am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501 "2018-07-25T09:06:24Z")
Hi team, I am trying to parse web server logs , i have return configuration file it looks as bellow input { file { path =\> "/var/log/nginx/access.log" type =\> "nginx-access" sincedb\_path =\> "/var/log/sincedb" st… --- ## [Logstash monitoring](https://discuss.elastic.co/t/logstash-monitoring/139828)
**Author:** [@saad](https://discuss.elastic.co/u/saad)\ **Replies:** 1\ **Last updated:** [July 25, 2018, 8:20am UTC](https://discuss.elastic.co/t/logstash-monitoring/139828 "2018-07-25T08:20:04Z")
I want to see my logstash monitoring in Kibana monitoring section. I did the following steps: in logstash.yml xpack.monitoring.enabled: true #xpack.monitoring.elasticsearch.username: logstash\_system #xpack.monitorin… --- ## [Grokparsefailure with multiple dates in logs](https://discuss.elastic.co/t/grokparsefailure-with-multiple-dates-in-logs/141512)
**Author:** [@sz3nt](https://discuss.elastic.co/u/sz3nt)\ **Replies:** 0\ **Last updated:** [July 25, 2018, 7:45am UTC](https://discuss.elastic.co/t/grokparsefailure-with-multiple-dates-in-logs/141512 "2018-07-25T07:45:43Z")
Hi! I have some old (hybris) logs to be parsed via ELK stack. I have made a well functioning grok matcher which workes on both https://grokdebug.herokuapp.com/ and http://grokconstructor.appspot.com/do/match, but fail… --- ## [Load Data from S3 with Rest Call for each record and merge response](https://discuss.elastic.co/t/load-data-from-s3-with-rest-call-for-each-record-and-merge-response/141461)
**Author:** [@vipindwivedi](https://discuss.elastic.co/u/vipindwivedi)\ **Replies:** 1\ **Last updated:** [July 25, 2018, 7:28am UTC](https://discuss.elastic.co/t/load-data-from-s3-with-rest-call-for-each-record-and-merge-response/141461 "2018-07-25T07:28:06Z")
Hi, We have use case to Read data from S3 bucket (zip Files). For each record make rest call to another service and merge the response with Input Data from File Load final data to elastic search Follow this process m… --- ## [Logstash-input-http\_poller install](https://discuss.elastic.co/t/logstash-input-http-poller-install/141434)
**Author:** [@m.sereda](https://discuss.elastic.co/u/m.sereda)\ **Replies:** 5\ **Last updated:** [July 25, 2018, 7:13am UTC](https://discuss.elastic.co/t/logstash-input-http-poller-install/141434 "2018-07-25T07:13:52Z")
Could you please explain me how to install logstash-input-http\_poller on a last ELK stack? As I read I should to go to cd /usr/share/elasticsearch and after that use command bin/elasticsearch-plugin install logstash-inp… --- ## [Logstash forwarder can not keep up with traffic](https://discuss.elastic.co/t/logstash-forwarder-can-not-keep-up-with-traffic/141483)
**Author:** [@sandipatmca](https://discuss.elastic.co/u/sandipatmca)\ **Replies:** 7\ **Last updated:** [July 25, 2018, 6:28am UTC](https://discuss.elastic.co/t/logstash-forwarder-can-not-keep-up-with-traffic/141483 "2018-07-25T06:28:21Z")
Logstash forwarder can not keep up with 10TPS traffic. After running traffic over the weekend at 19TPS split over 2 Core VMs, the forwarder took several hours to catch up (send the events queued). I suspect it to be a c… --- ## [NOT MAtching filter](https://discuss.elastic.co/t/not-matching-filter/141369)
**Author:** [@Abhishek\_3003](https://discuss.elastic.co/u/Abhishek_3003)\ **Replies:** 2\ **Last updated:** [July 25, 2018, 5:03am UTC](https://discuss.elastic.co/t/not-matching-filter/141369 "2018-07-25T05:03:18Z")
gc log: 2018-07-17T23:51:35.687+0530: 2315.919: \[GC (Allocation Failure) 2018-07-17T23:51:35.687+0530: 2315.919: \[ParNew: 12759500K-\>677810K(13212096K), 0.2544955 secs\] 20424219K-\>8668890K(38377920K), 0.2549210 secs\] \[T… --- ## [Heap memory](https://discuss.elastic.co/t/heap-memory/141347)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 1\ **Last updated:** [July 24, 2018, 9:47pm UTC](https://discuss.elastic.co/t/heap-memory/141347 "2018-07-24T21:47:52Z")
Are there ways to monitor the heap memory of logstash and edit its size. Are there commands for it? --- ## [Logstash JMX input plugin configuration error](https://discuss.elastic.co/t/logstash-jmx-input-plugin-configuration-error/140225)
**Author:** [@vamana](https://discuss.elastic.co/u/vamana)\ **Replies:** 26\ **Last updated:** [July 24, 2018, 5:34pm UTC](https://discuss.elastic.co/t/logstash-jmx-input-plugin-configuration-error/140225 "2018-07-24T17:34:23Z")
Hello, I am seeking some guidance regarding the configuration of the logstash jmx input plugin. I apologize for the formatting/wording of this as I'm quite certain it's wrong. Hopefully you can overlook this and provide… --- ## [Logstash filter to extract string from Json in postgresql table](https://discuss.elastic.co/t/logstash-filter-to-extract-string-from-json-in-postgresql-table/141252)
**Author:** [@Harman\_Gurm](https://discuss.elastic.co/u/Harman_Gurm)\ **Replies:** 5\ **Last updated:** [July 24, 2018, 4:19pm UTC](https://discuss.elastic.co/t/logstash-filter-to-extract-string-from-json-in-postgresql-table/141252 "2018-07-24T16:19:12Z")
Hi, I am using jdbc plugin to get data out of postgresql, but one of my column is having many values as below with 100 unique field names. I am looking to extract string from json format by logstash filter. id | … --- ## [Getting \_grokparsefailure exception while parsing customized Apache logs](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631)
**Author:** [@sm9922](https://discuss.elastic.co/u/sm9922)\ **Replies:** 3\ **Last updated:** [July 24, 2018, 3:34pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631 "2018-07-24T15:34:20Z")
Getting exception: \_grokparsefailure, while parsing customized Apache logs through Grok filter. It works perfectly fine with Grok debugger. Example of customized Apache log: quartz.texas.st.com:10001 10.10.10.10 - - … --- ## [Logstash 6.2.4 "x-pack" installation with custom JAVA\_HOME path](https://discuss.elastic.co/t/logstash-6-2-4-x-pack-installation-with-custom-java-home-path/139435)
**Author:** [@gt-28](https://discuss.elastic.co/u/gt-28)\ **Replies:** 1\ **Last updated:** [July 24, 2018, 3:18pm UTC](https://discuss.elastic.co/t/logstash-6-2-4-x-pack-installation-with-custom-java-home-path/139435 "2018-07-24T15:18:44Z")
I want to install x-pack with custom JAVA\_HOME path without getting conflicted with other applications. If I install Logstash-6.2.4 with custom java path and x-pack with application JAVA\_HOME directory, am getting the f… --- ## [Azure Activity Log to Logstash](https://discuss.elastic.co/t/azure-activity-log-to-logstash/141418)
**Author:** [@michaelsteven](https://discuss.elastic.co/u/michaelsteven)\ **Replies:** 0\ **Last updated:** [July 24, 2018, 3:16pm UTC](https://discuss.elastic.co/t/azure-activity-log-to-logstash/141418 "2018-07-24T15:16:47Z")
I want to have the Azure Monitor-Activity Log data piped into Elasticsearch, and using the Logstash Plug-in found here (https://github.com/logstash-plugins/logstash-input-azure\_event\_hubs). I have it configured and am a… --- ## [Logstash parsing is not giving exact value](https://discuss.elastic.co/t/logstash-parsing-is-not-giving-exact-value/141411)
**Author:** [@satendr](https://discuss.elastic.co/u/satendr)\ **Replies:** 1\ **Last updated:** [July 24, 2018, 2:59pm UTC](https://discuss.elastic.co/t/logstash-parsing-is-not-giving-exact-value/141411 "2018-07-24T14:59:40Z")
Hi , I am trying to parse a XML result file input { file { path =\> "C:/win10Automation/mytest/test\_out.xml" start\_position =\> "beginning" type =\> "xml" sincedb\_path =\> "/dev/null" codec =\> multiline { pattern =\> … --- ## [Problem indexing mapper\_parsing\_exception](https://discuss.elastic.co/t/problem-indexing-mapper-parsing-exception/140822)
**Author:** [@joshsmoore](https://discuss.elastic.co/u/joshsmoore)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 2:19pm UTC](https://discuss.elastic.co/t/problem-indexing-mapper-parsing-exception/140822 "2018-07-24T14:19:28Z")
I am placing this in Logstash because I think the problem is in the log stash processing even though it is raised by Elasticsearch. This is the exception I am seeing: central\_logger\_logstash.1.iz1mulhde4jx@logger-swarm… --- ## [Aggregate filter plugin not working](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374)
**Author:** [@Avinash\_Kumar](https://discuss.elastic.co/u/Avinash_Kumar)\ **Replies:** 3\ **Last updated:** [July 24, 2018, 2:00pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374 "2018-07-24T14:00:39Z")
i copied the exact same example on the documentation page: https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example1 with the filter and made the setup in logsta… --- ## [Fill placeholder on messages with partial field value of different field in Logstash](https://discuss.elastic.co/t/fill-placeholder-on-messages-with-partial-field-value-of-different-field-in-logstash/141126)
**Author:** [@sbienert](https://discuss.elastic.co/u/sbienert)\ **Replies:** 9\ **Last updated:** [July 24, 2018, 1:21pm UTC](https://discuss.elastic.co/t/fill-placeholder-on-messages-with-partial-field-value-of-different-field-in-logstash/141126 "2018-07-24T13:21:16Z")
Hello, I have placeholders in a log message. The message gets sent with a message extension which should replace these. The placeholders are numbers in brackets. The numbers inside should represent the line number of th… --- ## [Field keyword](https://discuss.elastic.co/t/field-keyword/141316)
**Author:** [@Pierre2](https://discuss.elastic.co/u/Pierre2)\ **Replies:** 1\ **Last updated:** [July 24, 2018, 11:53am UTC](https://discuss.elastic.co/t/field-keyword/141316 "2018-07-24T11:53:06Z")
Hello, My problem is that if I want to filter my field "ID appel.keyword" in kibana with the value SD6hb3401-55be9241cf7883a8d769e2f16c2747e2-v300g00 kibana show me two results. The problem is that the two results are … --- ## [One filter file for multiple filter plugins for different patterns](https://discuss.elastic.co/t/one-filter-file-for-multiple-filter-plugins-for-different-patterns/141365)
**Author:** [@atgaurav](https://discuss.elastic.co/u/atgaurav)\ **Replies:** 0\ **Last updated:** [July 24, 2018, 11:39am UTC](https://discuss.elastic.co/t/one-filter-file-for-multiple-filter-plugins-for-different-patterns/141365 "2018-07-24T11:39:20Z")
I am trying to process 2 files, each with data of different patterns. I have 2 individual filter configuration files which are working fine when parsing each respective file. I need help in consolidating one filter con… --- ## [How to filter using Grok](https://discuss.elastic.co/t/how-to-filter-using-grok/140855)
**Author:** [@udhaya\_kumar](https://discuss.elastic.co/u/udhaya_kumar)\ **Replies:** 5\ **Last updated:** [July 24, 2018, 11:19am UTC](https://discuss.elastic.co/t/how-to-filter-using-grok/140855 "2018-07-24T11:19:32Z")
2018-07-17 20:33:19 :: INFO :: Received Message from end System 12194779568228871 :: c.s.d.l.g.CBInitRequestListener:21 - Received a DDA Init Request from MCB...{ "header" : { "msgSender" : "MCB", "trackingId" : "M00… --- ## [Logstash Configuration with custom patterns](https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352)
**Author:** [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 10:25am UTC](https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352 "2018-07-24T10:25:13Z")
I want to read application specific logs especially for exception. So i created a "patterns" folder in config folder and added the patterns and the file looks like : #Extra patterns for grok EISLOGFORMAT %{TIMESTAMP\_IS… --- ## [Snippet q1](https://discuss.elastic.co/t/snippet-q1/141340)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 13\ **Last updated:** [July 24, 2018, 10:58am UTC](https://discuss.elastic.co/t/snippet-q1/141340 "2018-07-24T10:58:24Z")
what does this following snippet, especially the message line grok { match =\> { "message" =\> "CustomerID%{INT:CustomerID:int} "tag\_on\_failure" =\> \[\] } } [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=714) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=716)