# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=732 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 733 --- ## [How to check with \* wildcard condition in Logstash filter](https://discuss.elastic.co/t/how-to-check-with-wildcard-condition-in-logstash-filter/137770)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 11:09am UTC](https://discuss.elastic.co/t/how-to-check-with-wildcard-condition-in-logstash-filter/137770 "2018-06-28T11:09:38Z")
Hi, I am using Logstash GA 6.3.0. In my Logstash, inside filter, I am checking a url like; filter{ if \[requestUrl\] == "/section1/process1" { //doing some stuff here } } This is working fine. But this w… --- ## [Logstash could not be started because there is already another instance using the configured data directory - Windows7](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance-using-the-configured-data-directory-windows7/137349)
**Author:** [@thoppaen](https://discuss.elastic.co/u/thoppaen)\ **Replies:** 7\ **Last updated:** [June 28, 2018, 11:08am UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance-using-the-configured-data-directory-windows7/137349 "2018-06-28T11:08:16Z")
Hi, How do i kill multiple instances, i do not wish to run multiple instances of logstash, but however, it is getting created in the background! How do i kill it in windows 7. However, on changing the path.data in YML… --- ## [Need help on logstash.conf for Wildfly logs](https://discuss.elastic.co/t/need-help-on-logstash-conf-for-wildfly-logs/137549)
**Author:** [@Chandana](https://discuss.elastic.co/u/Chandana)\ **Replies:** 12\ **Last updated:** [June 28, 2018, 9:55am UTC](https://discuss.elastic.co/t/need-help-on-logstash-conf-for-wildfly-logs/137549 "2018-06-28T09:55:22Z")
I converted the wildfly logs to logstash readable format (Json). Here is how my log looks like {"@timestamp":"2018-06-22T18:36:55.138+0530","@message":"2018-06-22 18:36:55,138 INFO \[com.vcl.util.LogTracer\] (default t… --- ## [Unit logstash.service not found](https://discuss.elastic.co/t/unit-logstash-service-not-found/134423)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 9:45am UTC](https://discuss.elastic.co/t/unit-logstash-service-not-found/134423 "2018-06-28T09:45:49Z")
Just configured a new logstash server and when I went to restart logstash I found out that my logstash.service wasn't available. I tried to re-install logstash and get the following error: chmod: cannot access '/etc/de… --- ## [Redis input socketerror, Error: initialize: name or service not known](https://discuss.elastic.co/t/redis-input-socketerror-error-initialize-name-or-service-not-known/137721)
**Author:** [@layla](https://discuss.elastic.co/u/layla)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 7:44am UTC](https://discuss.elastic.co/t/redis-input-socketerror-error-initialize-name-or-service-not-known/137721 "2018-06-28T07:44:09Z")
I have configured a logstash before the log comes to elasticache for redis, below is the configuration and I can send the syslog to elasticache for redis successfully. indent preformatted text by 4 spaces input { s… --- ## [Logstash for Window IoT core OS](https://discuss.elastic.co/t/logstash-for-window-iot-core-os/137750)
**Author:** [@Naveen\_Nain](https://discuss.elastic.co/u/Naveen_Nain)\ **Replies:** 0\ **Last updated:** [June 28, 2018, 7:13am UTC](https://discuss.elastic.co/t/logstash-for-window-iot-core-os/137750 "2018-06-28T07:13:08Z")
I need to implement logging for UWP app running on Raspberry Pi having Windows IoT core OS. But I'm unable to find any documentation for windows IoT core OS. Is logstash supported for Windows IoT core OS? Any help is … --- ## [Problem in fetching logs from filebeat client ELK](https://discuss.elastic.co/t/problem-in-fetching-logs-from-filebeat-client-elk/137710)
**Author:** [@ajaykumar011](https://discuss.elastic.co/u/ajaykumar011)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 6:57am UTC](https://discuss.elastic.co/t/problem-in-fetching-logs-from-filebeat-client-elk/137710 "2018-06-28T06:57:13Z")
Can anyone help me with the the simple configuration which can collect logs from remoter webserver and show on Kibana by parsing logstash. I have tried many examples but unable to fetch logs from the client via filebeat. … --- ## [Logstash Hangs (thread blocked)](https://discuss.elastic.co/t/logstash-hangs-thread-blocked/137655)
**Author:** [@mzominy](https://discuss.elastic.co/u/mzominy)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 6:56am UTC](https://discuss.elastic.co/t/logstash-hangs-thread-blocked/137655 "2018-06-28T06:56:42Z")
Hi Everyone, We're running a Logstash pipeline with TCP input \> JSON filter \> ES output, and most of the time it goes great, except sometimes logstash will stop inserting data into ES without any log that we could find,… --- ## [Can I restart terminated pipelines?](https://discuss.elastic.co/t/can-i-restart-terminated-pipelines/137732)
**Author:** [@JohanRask](https://discuss.elastic.co/u/JohanRask)\ **Replies:** 0\ **Last updated:** [June 28, 2018, 5:53am UTC](https://discuss.elastic.co/t/can-i-restart-terminated-pipelines/137732 "2018-06-28T05:53:02Z")
Hi, We are using logstash with kafka + elasticsearch and running multiple pipelines which works great! However, under certain circumstances kafka input will receive an exception and the pipeline will terminate. If all… --- ## [Grok filter to ignore few lines of the logs and parse unstructured log file](https://discuss.elastic.co/t/grok-filter-to-ignore-few-lines-of-the-logs-and-parse-unstructured-log-file/137730)
**Author:** [@thoppaen](https://discuss.elastic.co/u/thoppaen)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 5:20am UTC](https://discuss.elastic.co/t/grok-filter-to-ignore-few-lines-of-the-logs-and-parse-unstructured-log-file/137730 "2018-06-28T05:20:49Z")
Hi, I am new to ELK, saying that, i m struggling with grok filters on parsing a robotic logs (generated by robots) The logs are unstructured with no certain pattern to write a grok filter. below are the samples of the… --- ## [Kibana Management - with Logstash](https://discuss.elastic.co/t/kibana-management-with-logstash/137698)
**Author:** [@Krishna2](https://discuss.elastic.co/u/Krishna2)\ **Replies:** 0\ **Last updated:** [June 27, 2018, 9:37pm UTC](https://discuss.elastic.co/t/kibana-management-with-logstash/137698 "2018-06-27T21:37:33Z")
Is it possible to integrate Kibana with Logstash in Kibana Management console without x-pack plugin? --- ## [INPUT read file after x seconds](https://discuss.elastic.co/t/input-read-file-after-x-seconds/137616)
**Author:** [@dyl](https://discuss.elastic.co/u/dyl)\ **Replies:** 3\ **Last updated:** [June 27, 2018, 8:23pm UTC](https://discuss.elastic.co/t/input-read-file-after-x-seconds/137616 "2018-06-27T20:23:11Z")
Hello, I use Logstash to read a directory where some log files from other applications are dumped. (PATH : /data/FLD/files/.../\*.log) Next, thanks to Logstash I filter these files to keep only which interest me. And … --- ## [Translate filter dictionary error in execution](https://discuss.elastic.co/t/translate-filter-dictionary-error-in-execution/137620)
**Author:** [@juanccert](https://discuss.elastic.co/u/juanccert)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 7:30pm UTC](https://discuss.elastic.co/t/translate-filter-dictionary-error-in-execution/137620 "2018-06-27T19:30:49Z")
I'm having problems to run logstash 6.2.2 with the translate filter: This is my translate filter code \<\> translate { field =\> "month" dictionary =\> {"01"=\>"Jan", "02"=\>"Feb"} destination =\> "monthletter" } \ I… --- ## [How to use Regex in Logstash config file to capture unidentified weblogicLogErrors](https://discuss.elastic.co/t/how-to-use-regex-in-logstash-config-file-to-capture-unidentified-weblogiclogerrors/137626)
**Author:** [@snehabh](https://discuss.elastic.co/u/snehabh)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 7:29pm UTC](https://discuss.elastic.co/t/how-to-use-regex-in-logstash-config-file-to-capture-unidentified-weblogiclogerrors/137626 "2018-06-27T19:29:25Z")
Hi All, My requirement is to identify all unknown Error present in log file\[or may occur in future\] for which i am capturing all known Error logs and trying to achieve it using regex along with conditional if. Problem … --- ## [Issue with message duplication](https://discuss.elastic.co/t/issue-with-message-duplication/137629)
**Author:** [@mikewitters](https://discuss.elastic.co/u/mikewitters)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 6:19pm UTC](https://discuss.elastic.co/t/issue-with-message-duplication/137629 "2018-06-27T18:19:31Z")
Using the ELK stack (6.2.2) to aggregate our application logs and almost everything is going well after a few bumps and bruises. The only issue that I see now is that the actual log statement the app writes is being dupl… --- ## [Sql\_last\_value resets to 1969-12-31 19.00.00 after logstash restart](https://discuss.elastic.co/t/sql-last-value-resets-to-1969-12-31-19-00-00-after-logstash-restart/137672)
**Author:** [@Arun\_Kumar\_N](https://discuss.elastic.co/u/Arun_Kumar_N)\ **Replies:** 0\ **Last updated:** [June 27, 2018, 5:56pm UTC](https://discuss.elastic.co/t/sql-last-value-resets-to-1969-12-31-19-00-00-after-logstash-restart/137672 "2018-06-27T17:56:35Z")
I have written a conf file as below to get data from Oracle SQL jdbc { jdbc\_driver\_library =\> "C:\\dev\\script\\config\\mssql-jdbc-6.2.2.jre8.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_… --- ## [Strugging with the date filter](https://discuss.elastic.co/t/strugging-with-the-date-filter/137648)
**Author:** [@JonConnor](https://discuss.elastic.co/u/JonConnor)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 5:13pm UTC](https://discuss.elastic.co/t/strugging-with-the-date-filter/137648 "2018-06-27T17:13:08Z")
Having a difficult time with the data filter. the 'message' field contains: 2018.06.27 00:22:23:209 UTC | FieldDebug | CommonPersistency my logstash filter: filter { date { match =\> \["message", "yyyy.MM.dd HH:mm:s… --- ## [Date Parse error Invalid format:](https://discuss.elastic.co/t/date-parse-error-invalid-format/137506)
**Author:** [@ashwinvemula](https://discuss.elastic.co/u/ashwinvemula)\ **Replies:** 5\ **Last updated:** [June 27, 2018, 4:28pm UTC](https://discuss.elastic.co/t/date-parse-error-invalid-format/137506 "2018-06-27T16:28:08Z")
curl -XPUT "http://localhost:9200/citrix" -H 'Content-Type: application/json' -d' { "mappings" : { "session\_details" : { "properties" : { "ASSOCIATED\_USER" : {"type": "text" }, "MACHINE\_NAME" : {"type": "text" }, … --- ## [Json parse failure even when the json is valid](https://discuss.elastic.co/t/json-parse-failure-even-when-the-json-is-valid/137609)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 6\ **Last updated:** [June 27, 2018, 4:27pm UTC](https://discuss.elastic.co/t/json-parse-failure-even-when-the-json-is-valid/137609 "2018-06-27T16:27:17Z")
conf filter: filter{ mutate { gsub =\> \[ "message","\\r","", "message","\\n","", "message"," ","" \] } grok { match =\> { "message" =\> "^%{YEAR:year}-%{MONTH:month}-%{MONTHDAY:day} %{TIME:time} %{GREEDYDATA:pam} \[… --- ## [Translate within mutate section](https://discuss.elastic.co/t/translate-within-mutate-section/137633)
**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 3:29pm UTC](https://discuss.elastic.co/t/translate-within-mutate-section/137633 "2018-06-27T15:29:33Z")
hi i want to add some info in the event that a list of specific ips are contacted, from what i've seen the translate filter should be able to do this but i dont know if where to place it correctly below is not working i… --- ## [Logstash resends logs after they finish?](https://discuss.elastic.co/t/logstash-resends-logs-after-they-finish/137650)
**Author:** [@magdieldominguez](https://discuss.elastic.co/u/magdieldominguez)\ **Replies:** 0\ **Last updated:** [June 27, 2018, 2:58pm UTC](https://discuss.elastic.co/t/logstash-resends-logs-after-they-finish/137650 "2018-06-27T14:58:07Z")
Hi I am monitoring a set of log files with Logstash and sending them to Elasticsearch. But it seems like after the logs are done logstash resends the logs from the files again, leaving me with duplicate data in elastics… --- ## [Parsing error when reading from redis](https://discuss.elastic.co/t/parsing-error-when-reading-from-redis/137198)
**Author:** [@cowensel](https://discuss.elastic.co/u/cowensel)\ **Replies:** 5\ **Last updated:** [June 27, 2018, 1:25pm UTC](https://discuss.elastic.co/t/parsing-error-when-reading-from-redis/137198 "2018-06-27T13:25:23Z")
I am seeing the following error when reading a Json event from Redis. 'Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"log4net-2018.06.25", :\_type=\>"test", :\_routing=\>nil},… --- ## [Why log comming from filebeat are automaticaly parsed with output elastic and not with logstash](https://discuss.elastic.co/t/why-log-comming-from-filebeat-are-automaticaly-parsed-with-output-elastic-and-not-with-logstash/137619)
**Author:** [@artonge](https://discuss.elastic.co/u/artonge)\ **Replies:** 0\ **Last updated:** [June 27, 2018, 12:50pm UTC](https://discuss.elastic.co/t/why-log-comming-from-filebeat-are-automaticaly-parsed-with-output-elastic-and-not-with-logstash/137619 "2018-06-27T12:50:12Z")
Hi, When I set the output to elastic in my filebeat config, all the logs from modules like apache2 are automatically parsed but when I send them to logstash, they are not. Is this a wanted behaviour ? Couldn't they be… --- ## [Monitoring for logstash 6.3 cannot be used](https://discuss.elastic.co/t/monitoring-for-logstash-6-3-cannot-be-used/137597)
**Author:** [@BallGhost](https://discuss.elastic.co/u/BallGhost)\ **Replies:** 4\ **Last updated:** [June 27, 2018, 12:14pm UTC](https://discuss.elastic.co/t/monitoring-for-logstash-6-3-cannot-be-used/137597 "2018-06-27T12:14:50Z")
Recently I upgraded to ELK6.3 from 6.2.2，but the monitoring for logstash could not be displayed on kibana. The monitoring for ES and kibana is normal. Here is the logstash.yml """ ... xpack.monitoring.enabled: true … --- ## [Logstash (logstash 2.2.4) failing to start taking Kafka Input with bootstrap\_servers option](https://discuss.elastic.co/t/logstash-logstash-2-2-4-failing-to-start-taking-kafka-input-with-bootstrap-servers-option/137600)
**Author:** [@rajendra\_naidu](https://discuss.elastic.co/u/rajendra_naidu)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 11:11am UTC](https://discuss.elastic.co/t/logstash-logstash-2-2-4-failing-to-start-taking-kafka-input-with-bootstrap-servers-option/137600 "2018-06-27T11:11:53Z")
With reference to "Modern Kafka clients do not connect to Zookeeper. Historical versions of Kafka exposed Zookeeper to clients to retrieve the full broker list (Kafka 0.7) and the initial consumer groups were implemented… --- ## [Logstash file plugin schedule](https://discuss.elastic.co/t/logstash-file-plugin-schedule/137456)
**Author:** [@sysdradmin](https://discuss.elastic.co/u/sysdradmin)\ **Replies:** 5\ **Last updated:** [June 27, 2018, 11:09am UTC](https://discuss.elastic.co/t/logstash-file-plugin-schedule/137456 "2018-06-27T11:09:49Z")
Hello, How to cron task with logstash and file plugin ? with jdbc plugin it's integrate but not found with file plugin. we use start\_interval and discover\_interval but not really work. ( stat\_interval =\> 30 discover… --- ## [Logstash not pushing data to AWS Elastcisearch](https://discuss.elastic.co/t/logstash-not-pushing-data-to-aws-elastcisearch/137579)
**Author:** [@Shweta\_Priyadarshani](https://discuss.elastic.co/u/Shweta_Priyadarshani)\ **Replies:** 7\ **Last updated:** [June 27, 2018, 10:19am UTC](https://discuss.elastic.co/t/logstash-not-pushing-data-to-aws-elastcisearch/137579 "2018-06-27T10:19:45Z")
Hello everyone, I am trying to push logs from logstash to Elasticsearch but its giving below error Sending Logstash's logs to D:/shweta/ELK\_poc/logstash-6.3.0/logs which is now configured via log4j2.properties \[2018-0… --- ## [Logstash not giving output log events on console](https://discuss.elastic.co/t/logstash-not-giving-output-log-events-on-console/137421)
**Author:** [@Shweta\_Priyadarshani](https://discuss.elastic.co/u/Shweta_Priyadarshani)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 9:23am UTC](https://discuss.elastic.co/t/logstash-not-giving-output-log-events-on-console/137421 "2018-06-27T09:23:44Z")
Hi Everyone, I am new to logstash. I am trying to run a logstash config file but facing a problem as discussed on the link : Lateron in the post its mentioned that the issue got resolved as "It turns out my first log… --- ## [Retrying failed action with response code](https://discuss.elastic.co/t/retrying-failed-action-with-response-code/137551)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 3\ **Last updated:** [June 27, 2018, 9:19am UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code/137551 "2018-06-27T09:19:43Z")
logstash error log:retrying failed action with response code --- ## [How to get the Metric Tag working using JDBC](https://discuss.elastic.co/t/how-to-get-the-metric-tag-working-using-jdbc/137576)
**Author:** [@Tyler\_Amos](https://discuss.elastic.co/u/Tyler_Amos)\ **Replies:** 0\ **Last updated:** [June 27, 2018, 8:51am UTC](https://discuss.elastic.co/t/how-to-get-the-metric-tag-working-using-jdbc/137576 "2018-06-27T08:51:13Z")
I'm trying to create an Emails dashboard using the built in Metrics tag where the email information is being pulled from on Oracle Database. The query is below: SELECT id , status , first\_requested\_date , first\_sent\_d… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=731) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=733)