# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=717 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 718 --- ## [Logstash Configuration throwing 400](https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173)
**Author:** [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 12:34pm UTC](https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173 "2018-07-23T12:34:32Z")
I am new to ELK stack and trying the below configuration and i've mentioned the exception as well please suggest :slight\_smile: input { file { type =\> "java" path =\> "C:\\data\\Logs\_20180720\\eis\_log\_file.log" start\_p… --- ## [Logstash group imbalance due consumer thread!](https://discuss.elastic.co/t/logstash-group-imbalance-due-consumer-thread/141075)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 12:01pm UTC](https://discuss.elastic.co/t/logstash-group-imbalance-due-consumer-thread/141075 "2018-07-23T12:01:11Z")
I have below configuration in Logstash from kafka , input { kafka { bootstrap\_servers =\> "server1 , server2 , server3" security\_protocol =\> "SASL\_PLAINTEXT" sasl\_mechanism =\> "PLAIN" jaas\_path =\> "/etc/logstash/kaf… --- ## [JDBC Input plugin doesn't forward username and password to MySQL](https://discuss.elastic.co/t/jdbc-input-plugin-doesnt-forward-username-and-password-to-mysql/141148)
**Author:** [@Mor\_Paz](https://discuss.elastic.co/u/Mor_Paz)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 11:46am UTC](https://discuss.elastic.co/t/jdbc-input-plugin-doesnt-forward-username-and-password-to-mysql/141148 "2018-07-23T11:46:02Z")
I am trying to use the jdbc input plugin to get data from my MySQL DB to my Elasticsearch server, I have installed a mysql-connector-java-8.0.11-1.el7.noarch package and my Logstash is already running fine for other inpu… --- ## [Elapsed filter, problem with configuration?](https://discuss.elastic.co/t/elapsed-filter-problem-with-configuration/141155)
**Author:** [@bigster](https://discuss.elastic.co/u/bigster)\ **Replies:** 0\ **Last updated:** [July 23, 2018, 11:22am UTC](https://discuss.elastic.co/t/elapsed-filter-problem-with-configuration/141155 "2018-07-23T11:22:26Z")
I'm trying to create an elapsed filter but the elapsed fields don't appear. This is the input: statement =\> "SELECT TRANSACTION\_ID, COMMUNICATION\_ID, BROKER\_NAME, IS\_NAME, SERVICE\_NAME, OPERATION\_NAME, OPERATION\_VE… --- ## [Jdbc\_streaming filter plugin returns an empty set using parameters option](https://discuss.elastic.co/t/jdbc-streaming-filter-plugin-returns-an-empty-set-using-parameters-option/141042)
**Author:** [@realand](https://discuss.elastic.co/u/realand)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 10:47am UTC](https://discuss.elastic.co/t/jdbc-streaming-filter-plugin-returns-an-empty-set-using-parameters-option/141042 "2018-07-23T10:47:41Z")
HELLO, I'm using the jdbc input plugin to get data from "table1": statement =\> "SELECT \* FROM table1 where id=1" Result is : id:1 and id\_subscriber:1 Then I'm using the jdbc\_streaming filter plugin to get more data f… --- ## [Discrete grokparse failures](https://discuss.elastic.co/t/discrete-grokparse-failures/141144)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 0\ **Last updated:** [July 23, 2018, 10:39am UTC](https://discuss.elastic.co/t/discrete-grokparse-failures/141144 "2018-07-23T10:39:30Z")
HI Team, I working parsing the below set of documents. 2018-06-11 04:28:20,580 \[\[ACTIVE\] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'\] DEBUG c.f.a.d.r.impl.ClientRepositoryImpl - This client:\[t… --- ## [\[Logstash.filters.jdbc.readwritedatabase\]- No current connection](https://discuss.elastic.co/t/logstash-filters-jdbc-readwritedatabase-no-current-connection/141068)
**Author:** [@wm1994](https://discuss.elastic.co/u/wm1994)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 10:33am UTC](https://discuss.elastic.co/t/logstash-filters-jdbc-readwritedatabase-no-current-connection/141068 "2018-07-23T10:33:18Z")
Hello, I'm trying to set up a logstash 6.2.1 pipeline that does an enrichment lookup via the jdbc\_static plugin. But I got an error like this: \[2018-07-23 05:39:26.291\] \[ERROR\] \[\[main\]-pipeline-manager\] \[logstash.filter… --- ## [How we can correlate current event value with stored index value from elasticsearch](https://discuss.elastic.co/t/how-we-can-correlate-current-event-value-with-stored-index-value-from-elasticsearch/140570)
**Author:** [@yash\_mangla](https://discuss.elastic.co/u/yash_mangla)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 9:52am UTC](https://discuss.elastic.co/t/how-we-can-correlate-current-event-value-with-stored-index-value-from-elasticsearch/140570 "2018-07-23T09:52:28Z")
Hi Folks, We are collecting real-time feeds from multiple sources using logstash. however, we stored some of our identification in elasticsearch index manually. Now, we are looking for filter plugin in logstash who can … --- ## [Log stash output config to refresh the indexed data in elastic search](https://discuss.elastic.co/t/log-stash-output-config-to-refresh-the-indexed-data-in-elastic-search/141125)
**Author:** [@raghav1107](https://discuss.elastic.co/u/raghav1107)\ **Replies:** 0\ **Last updated:** [July 23, 2018, 9:28am UTC](https://discuss.elastic.co/t/log-stash-output-config-to-refresh-the-indexed-data-in-elastic-search/141125 "2018-07-23T09:28:54Z")
I am using the below log stash config to fetch the data from MYSQL and pushing into elastic search. How can we configure log stash output to have only the refreshed data from MYSQL into elastic search ? The existing inde… --- ## [Getting Grokparse Failures with Incomplete Logs displayed](https://discuss.elastic.co/t/getting-grokparse-failures-with-incomplete-logs-displayed/139890)
**Author:** [@Vanya\_Sharma](https://discuss.elastic.co/u/Vanya_Sharma)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 8:57am UTC](https://discuss.elastic.co/t/getting-grokparse-failures-with-incomplete-logs-displayed/139890 "2018-07-23T08:57:17Z")
Hi All, I'm using logstash 1.5.4-9 with multiline filter to parse and send logs to Elasticsearch 1.7.4. My configuration looks something like: input { file { type =\> "abc" tags =\> "abc" … --- ## [Grok Pattern - Need help](https://discuss.elastic.co/t/grok-pattern-need-help/141088)
**Author:** [@Vinod\_Awanti](https://discuss.elastic.co/u/Vinod_Awanti)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 8:29am UTC](https://discuss.elastic.co/t/grok-pattern-need-help/141088 "2018-07-23T08:29:46Z")
Hi, I'm totally new to ELK and logstash with Grok patterns.. I was able to parse and extract Apache logs using ( grok { match =\> { "message" =\> "%{COMMONAPACHELOG}" } } ). but I do have one more application with diff… --- ## [Unable to run logstash on windows 8.1](https://discuss.elastic.co/t/unable-to-run-logstash-on-windows-8-1/137787)
**Author:** [@Revati\_Chawla](https://discuss.elastic.co/u/Revati_Chawla)\ **Replies:** 15\ **Last updated:** [July 23, 2018, 6:49am UTC](https://discuss.elastic.co/t/unable-to-run-logstash-on-windows-8-1/137787 "2018-07-23T06:49:08Z")
Hi I am unable to run logstash on windows 8.1 After running the command inside bin of logstash, logstash -f "filename.config" on the command prompt, I get a java.langException where it states that logstash stopped pr… --- ## [Logstash\_scripted fields](https://discuss.elastic.co/t/logstash-scripted-fields/141083)
**Author:** [@dinesh1](https://discuss.elastic.co/u/dinesh1)\ **Replies:** 0\ **Last updated:** [July 23, 2018, 6:21am UTC](https://discuss.elastic.co/t/logstash-scripted-fields/141083 "2018-07-23T06:21:40Z")
HI, Iam using filebeat----\>logstash---\>elasticsearch---kibana how to create scripted field for my logs in kibana. I need to create field for trace. MY log example is shown below. {“@timestamp”:29T03:45:00.000+00:00",… --- ## [Jdbc input for oracle blob field error](https://discuss.elastic.co/t/jdbc-input-for-oracle-blob-field-error/139861)
**Author:** [@Yosen](https://discuss.elastic.co/u/Yosen)\ **Replies:** 7\ **Last updated:** [July 23, 2018, 1:01am UTC](https://discuss.elastic.co/t/jdbc-input-for-oracle-blob-field-error/139861 "2018-07-23T01:01:37Z")
Dear experts: I'm using the jdbc input to load data from a oracle table to ES. There is a blob field in the table. If the blob field only have text content, it can transfer to ES. But when this filed have some binary d… --- ## [Setup.bat file is not recognized as an internal or external command, operable program or batch file](https://discuss.elastic.co/t/setup-bat-file-is-not-recognized-as-an-internal-or-external-command-operable-program-or-batch-file/141053)
**Author:** [@Shraddha\_Srivastav](https://discuss.elastic.co/u/Shraddha_Srivastav)\ **Replies:** 1\ **Last updated:** [July 22, 2018, 10:21pm UTC](https://discuss.elastic.co/t/setup-bat-file-is-not-recognized-as-an-internal-or-external-command-operable-program-or-batch-file/141053 "2018-07-22T22:21:48Z")
Hi guys, i m trying to run my config file to pass the data to the ES. I have the error in running my config file. Please help! below is the snapshot of config file which i have saved in my bin folder. Also, i m not … --- ## [Index Lookup and insert](https://discuss.elastic.co/t/index-lookup-and-insert/140610)
**Author:** [@Sandeep\_Bharmoria](https://discuss.elastic.co/u/Sandeep_Bharmoria)\ **Replies:** 1\ **Last updated:** [July 22, 2018, 6:11pm UTC](https://discuss.elastic.co/t/index-lookup-and-insert/140610 "2018-07-22T18:11:18Z")
Hi, I have an index named \*\*"Student\_info"\*\* and have 2 fields in it (one is roll number, second is name). Now I am ingesting data in second index named \*\*"penalties"\*\* from some csv file (this csv contains \*\*class\*… --- ## [How does logstash route the data to a NEW primary ES node, not the old one?](https://discuss.elastic.co/t/how-does-logstash-route-the-data-to-a-new-primary-es-node-not-the-old-one/141030)
**Author:** [@Jacob\_Smith](https://discuss.elastic.co/u/Jacob_Smith)\ **Replies:** 6\ **Last updated:** [July 22, 2018, 5:32pm UTC](https://discuss.elastic.co/t/how-does-logstash-route-the-data-to-a-new-primary-es-node-not-the-old-one/141030 "2018-07-22T17:32:55Z")
I'm trying to wrap my head around something. I have 3 ES nodes, with just 1 shard for simplicity. The first node is just the master node. The second node holds the primary shard and the third one holds the replica shard. … --- ## [Unable to create index in elasticsearch](https://discuss.elastic.co/t/unable-to-create-index-in-elasticsearch/140615)
**Author:** [@APJ](https://discuss.elastic.co/u/APJ)\ **Replies:** 3\ **Last updated:** [July 22, 2018, 4:46pm UTC](https://discuss.elastic.co/t/unable-to-create-index-in-elasticsearch/140615 "2018-07-22T16:46:53Z")
Hi all, I am following this link (Link) to display live weather data on Kibana. I used the logstash configuration explained in the pdf. Here is my logstash configuration: input { exec { command =\> 'curl --silen… --- ## [Add\_field order of execution](https://discuss.elastic.co/t/add-field-order-of-execution/141036)
**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\ **Replies:** 2\ **Last updated:** [July 22, 2018, 3:37pm UTC](https://discuss.elastic.co/t/add-field-order-of-execution/141036 "2018-07-22T15:37:55Z")
I've noticed that the add\_field operation is executed last - this is not explicitly documented and causes unexpected behavior when doing something like: mutate { add\_field =\> {"target" =\> "foo"} add\_field =\> {"\[@met… --- ## [How We can extract query](https://discuss.elastic.co/t/how-we-can-extract-query/141021)
**Author:** [@Mojtaba\_Motamed](https://discuss.elastic.co/u/Mojtaba_Motamed)\ **Replies:** 1\ **Last updated:** [July 22, 2018, 11:49am UTC](https://discuss.elastic.co/t/how-we-can-extract-query/141021 "2018-07-22T11:49:01Z")
I have this url https://www.reddit.com/search?q=apple i want to extract query parameter from thie url how? --- ## [Mismatch in field type](https://discuss.elastic.co/t/mismatch-in-field-type/140199)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 6\ **Last updated:** [July 22, 2018, 10:39am UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199 "2018-07-22T10:39:21Z")
Hi Team, I am new to ELK stack and i have completed setting up all ELKStack components such as filebeat ,logstash, Elastic and kibana on a single server and was successful in all my trails attempts, however when trying … --- ## [Cannot retrieve cgroups information](https://discuss.elastic.co/t/cannot-retrieve-cgroups-information/141009)
**Author:** [@wanzi](https://discuss.elastic.co/u/wanzi)\ **Replies:** 0\ **Last updated:** [July 21, 2018, 5:32pm UTC](https://discuss.elastic.co/t/cannot-retrieve-cgroups-information/141009 "2018-07-21T17:32:45Z")
Hi all, I got a problem from filebeat to logstash. The error message is as below: \[2018-07-21T13:27:39,692\]\[DEBUG\]\[logstash.instrument.periodicpoller.cgroup\] Error, cannot retrieve cgroups information {:exception=\>"No… --- ## [Use logstash conf file to load data in production environment](https://discuss.elastic.co/t/use-logstash-conf-file-to-load-data-in-production-environment/141007)
**Author:** [@BolaBLG](https://discuss.elastic.co/u/BolaBLG)\ **Replies:** 0\ **Last updated:** [July 21, 2018, 5:22pm UTC](https://discuss.elastic.co/t/use-logstash-conf-file-to-load-data-in-production-environment/141007 "2018-07-21T17:22:18Z")
Hi ! I'm a beginner with ELK Stack. I used to test it till now. So i installed E L & K by unzipping them and using them in command line. Especially when I have to load data (eg : CSV) for vizualization in Kibana, I used… --- ## [Logstash plugin authenticate WebHDFS with Knox](https://discuss.elastic.co/t/logstash-plugin-authenticate-webhdfs-with-knox/140067)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 0\ **Last updated:** [July 16, 2018, 12:23am UTC](https://discuss.elastic.co/t/logstash-plugin-authenticate-webhdfs-with-knox/140067 "2018-07-16T00:23:06Z")
Does someone know if logstash plugin support authentication with Knox ? I'm running logstash-6.3.1 (not ELK distribution) locally on windows trying to push data to hdfs (on remote server) with webhdfs and authenticate w… --- ## [TCP output throws NPE with ssl](https://discuss.elastic.co/t/tcp-output-throws-npe-with-ssl/140942)
**Author:** [@jswid](https://discuss.elastic.co/u/jswid)\ **Replies:** 1\ **Last updated:** [July 20, 2018, 5:39pm UTC](https://discuss.elastic.co/t/tcp-output-throws-npe-with-ssl/140942 "2018-07-20T17:39:32Z")
I am using TCP output with ssl certs and the logstash-6.3.1. All components are 6.3.1, as this is a relatively new install. The flow is using two logstash nodes that use input to tcp output on the sending side, then tc… --- ## [Ingest with Jdbc input plugin in append](https://discuss.elastic.co/t/ingest-with-jdbc-input-plugin-in-append/140525)
**Author:** [@Fedele\_Mantuano](https://discuss.elastic.co/u/Fedele_Mantuano)\ **Replies:** 3\ **Last updated:** [July 21, 2018, 7:36am UTC](https://discuss.elastic.co/t/ingest-with-jdbc-input-plugin-in-append/140525 "2018-07-21T07:36:58Z")
Hi at all, I'm working with Jdbc input plugin that I use to ingest a table from mysql to elasticsearch. Now I have a problem. Is it possible to ingest only the new data in Elasticsearch? I'd like to store data in appe… --- ## [Json Codec dealing with NaN, Inf](https://discuss.elastic.co/t/json-codec-dealing-with-nan-inf/138611)
**Author:** [@alex3](https://discuss.elastic.co/u/alex3)\ **Replies:** 3\ **Last updated:** [July 21, 2018, 5:12am UTC](https://discuss.elastic.co/t/json-codec-dealing-with-nan-inf/138611 "2018-07-21T05:12:05Z")
Hello, I am trying to use the json codec to parse json files that have NaN and Inf as values; however, it doesn't work. I am getting the following error message: \[2018-07-04T17:03:36,005\]\[ERROR\]\[logstash.codecs.json … --- ## [Problems with geo\_point](https://discuss.elastic.co/t/problems-with-geo-point/140967)
**Author:** [@noob\_cakes](https://discuss.elastic.co/u/noob_cakes)\ **Replies:** 7\ **Last updated:** [July 20, 2018, 11:57pm UTC](https://discuss.elastic.co/t/problems-with-geo-point/140967 "2018-07-20T23:57:52Z")
Hello all, I'm very new to elastic, so please bear with me. I'm trying to get a data type 'geo\_point' in ES 6.3 via a template referenced in my logstash pipeline. I'm getting geo data populating in elasticsearch, just n… --- ## [Fluentd configuration for logstash not working](https://discuss.elastic.co/t/fluentd-configuration-for-logstash-not-working/140961)
**Author:** [@Krishna2](https://discuss.elastic.co/u/Krishna2)\ **Replies:** 1\ **Last updated:** [July 20, 2018, 9:16pm UTC](https://discuss.elastic.co/t/fluentd-configuration-for-logstash-not-working/140961 "2018-07-20T21:16:26Z")
this is my simple logstash config for fluentd. I saw from documentation that fluentd running on port 8888. Also I could not output to Elasticsearch. and it says connection refused. can some one tell me what is wrong … --- ## [TCP Input - restarting pipeline "stalled" indefinitely and will not shut down](https://discuss.elastic.co/t/tcp-input-restarting-pipeline-stalled-indefinitely-and-will-not-shut-down/140955)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 1\ **Last updated:** [July 20, 2018, 8:22pm UTC](https://discuss.elastic.co/t/tcp-input-restarting-pipeline-stalled-indefinitely-and-will-not-shut-down/140955 "2018-07-20T20:22:44Z")
Using TCP input breaks shutdown/restart. the pipeline will not reload if the configuration changes. Version: Logstash v6.3.0, logstash-input-tcp v5.0.9 Operating System: Windows Server 2012 Config File (if you have se… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=716) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=718)