# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=734 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 735 --- ## [Logstash not starting and elastic complaining about old user](https://discuss.elastic.co/t/logstash-not-starting-and-elastic-complaining-about-old-user/137412)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 0\ **Last updated:** [June 26, 2018, 10:00am UTC](https://discuss.elastic.co/t/logstash-not-starting-and-elastic-complaining-about-old-user/137412 "2018-06-26T10:00:49Z")
Hi I am unable to get logstash to send data to its pipeline ever since i changed the user accounts of the cluster. I think it's trying to use an old logstash user to write to its pipeline but even if i change it back to… --- ## [Grok parser efficiency](https://discuss.elastic.co/t/grok-parser-efficiency/137405)
**Author:** [@safhw91](https://discuss.elastic.co/u/safhw91)\ **Replies:** 4\ **Last updated:** [June 26, 2018, 9:57am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405 "2018-06-26T09:57:33Z")
Example portion of my grok parser: match =\> { "message" =\> "(?\[^ \]) (?.)" } Problem: according to this my string fields are going to be both a "text" and "keyword". I am pretty sure this isn't ideal for memory usage (m… --- ## [Problem while using dissect plugin to parse logs](https://discuss.elastic.co/t/problem-while-using-dissect-plugin-to-parse-logs/137354)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 2\ **Last updated:** [June 26, 2018, 9:53am UTC](https://discuss.elastic.co/t/problem-while-using-dissect-plugin-to-parse-logs/137354 "2018-06-26T09:53:37Z")
Hi i have a requirement of parsing netstat logs using logstash, sample logs looks like bellow: the logstash configuration which i tried is here: input { file { path =\> "/home/samplelog" start\_position =\> "beg… --- ## [OSSEC + Logstash combination](https://discuss.elastic.co/t/ossec-logstash-combination/137407)
**Author:** [@br14nb0](https://discuss.elastic.co/u/br14nb0)\ **Replies:** 0\ **Last updated:** [June 26, 2018, 9:46am UTC](https://discuss.elastic.co/t/ossec-logstash-combination/137407 "2018-06-26T09:46:04Z")
Does anyone try to use OSSEC agent push raw log directly to Logstash instead of OSSEC server ? and if yes, is there an input plugin for this job ? Thanks --- ## [How to run logstash conf file in background?](https://discuss.elastic.co/t/how-to-run-logstash-conf-file-in-background/137022)
**Author:** [@mamta](https://discuss.elastic.co/u/mamta)\ **Replies:** 6\ **Last updated:** [June 26, 2018, 9:33am UTC](https://discuss.elastic.co/t/how-to-run-logstash-conf-file-in-background/137022 "2018-06-26T09:33:00Z")
Hey, I have installed ELK 5.6.8 on Redhat machine. I am using this to show MySQL database records on kibana. I have kept mysql\_logstash.conf file in /etc/logstash/conf.d directory but still it's not running in the backe… --- ## [CSV output plugin: encoding](https://discuss.elastic.co/t/csv-output-plugin-encoding/137384)
**Author:** [@Jean-Marc\_Autexier](https://discuss.elastic.co/u/Jean-Marc_Autexier)\ **Replies:** 4\ **Last updated:** [June 26, 2018, 9:18am UTC](https://discuss.elastic.co/t/csv-output-plugin-encoding/137384 "2018-06-26T09:18:08Z")
Hi, I'm reading data usign jdbc from a database and writing them into a CSV file using the logstash csv output plugin. The data contains UTF-8 charcaters. How can I configure the encoding of the csv fiel to UTF-8? br… --- ## [How many consumer\_threads of Kafka input to configure if duplicate Logstash instances](https://discuss.elastic.co/t/how-many-consumer-threads-of-kafka-input-to-configure-if-duplicate-logstash-instances/137402)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 0\ **Last updated:** [June 26, 2018, 9:13am UTC](https://discuss.elastic.co/t/how-many-consumer-threads-of-kafka-input-to-configure-if-duplicate-logstash-instances/137402 "2018-06-26T09:13:57Z")
Hi, I am using ELK GA 6.3.0. I am consuming from a Kafka topic which has 11 partitions. My configuration is like below; input { kafka{ group\_id =\> "group1" topics =\> \["topic1"\] bootstrap\_servers =\> "192.168.0.1:… --- ## [Drop logs from particular hostname](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355)
**Author:** [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Replies:** 3\ **Last updated:** [June 26, 2018, 8:35am UTC](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355 "2018-06-26T08:35:00Z")
How to drop/ disable parsing logs from particular hosts using logstash? I have disabled hostdetails in a db table. How to make config file to make this happen? please suggest --- ## [Logstash forwarder SSL + k8s](https://discuss.elastic.co/t/logstash-forwarder-ssl-k8s/137390)
**Author:** [@Saravana\_Kumar](https://discuss.elastic.co/u/Saravana_Kumar)\ **Replies:** 0\ **Last updated:** [June 26, 2018, 8:31am UTC](https://discuss.elastic.co/t/logstash-forwarder-ssl-k8s/137390 "2018-06-26T08:31:43Z")
how to add logstash forwarder SSL certs on a filebeat daemon/deployment on a kubernetes cluster , I can understand that using environmental variables we can pass the username/password as credentials but it needs to be do… --- ## [Threat Intelligence Plugin](https://discuss.elastic.co/t/threat-intelligence-plugin/137387)
**Author:** [@br14nb0](https://discuss.elastic.co/u/br14nb0)\ **Replies:** 0\ **Last updated:** [June 26, 2018, 8:21am UTC](https://discuss.elastic.co/t/threat-intelligence-plugin/137387 "2018-06-26T08:21:15Z")
Does Logstash have Threat Intelligence Plugin or something like threat feeder ? Thanks, I prefer with free version --- ## [Change field value within to another value](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039)
**Author:** [@SuperK\_1860](https://discuss.elastic.co/u/SuperK_1860)\ **Replies:** 5\ **Last updated:** [June 26, 2018, 7:17am UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039 "2018-06-26T07:17:10Z")
Good day Could someone please let me know what filter plugin or process I would need to do to change a field value. By this I mean I have a column that I want to input via csv, I am good and using the filter csv plugin… --- ## [Make Grok filter fields aggregatable](https://discuss.elastic.co/t/make-grok-filter-fields-aggregatable/137345)
**Author:** [@bobbytan](https://discuss.elastic.co/u/bobbytan)\ **Replies:** 3\ **Last updated:** [June 26, 2018, 7:02am UTC](https://discuss.elastic.co/t/make-grok-filter-fields-aggregatable/137345 "2018-06-26T07:02:47Z")
Hello, I have succesfully filtered out fields needed from logs by using GROK.The data within these field shown in stdout are correct,however these fields(error code &loglevel) are not aggregatable in kibana.How do I cha… --- ## [\_dateparsefailure reported in tags even after date is matched](https://discuss.elastic.co/t/dateparsefailure-reported-in-tags-even-after-date-is-matched/137181)
**Author:** [@ishantanu](https://discuss.elastic.co/u/ishantanu)\ **Replies:** 17\ **Last updated:** [June 26, 2018, 5:44am UTC](https://discuss.elastic.co/t/dateparsefailure-reported-in-tags-even-after-date-is-matched/137181 "2018-06-26T05:44:28Z")
Hi, I am using date filter to convert the field to date type. Here's how the field looks like: subdata\_proc\_date: 24 Jun 2018 14:47:14,891 The date filter I've written for this is: date { match =\> \[ "subdat… --- ## [I cant restart and config logstash](https://discuss.elastic.co/t/i-cant-restart-and-config-logstash/137115)
**Author:** [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)\ **Replies:** 8\ **Last updated:** [June 26, 2018, 5:15am UTC](https://discuss.elastic.co/t/i-cant-restart-and-config-logstash/137115 "2018-06-26T05:15:53Z")
my logstash doesn't send data to elasticsearch and when i try restart it i get this error: Logstash - java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (GemspecError) There was a LoadError while loadi… --- ## [Logstash error: Error occured during the initialization of VM](https://discuss.elastic.co/t/logstash-error-error-occured-during-the-initialization-of-vm/137356)
**Author:** [@Deniz\_Cinar](https://discuss.elastic.co/u/Deniz_Cinar)\ **Replies:** 0\ **Last updated:** [June 26, 2018, 4:53am UTC](https://discuss.elastic.co/t/logstash-error-error-occured-during-the-initialization-of-vm/137356 "2018-06-26T04:53:09Z")
Hello all, I was able to start logstash without any error and i dont know what happened but now it gives an error like: Error occured during the initialization of VM java\\lang\\noclassdeffounderror: java\\lang\\Object C… --- ## [How do I make logstash not automatically bind 9200 to my ES url](https://discuss.elastic.co/t/how-do-i-make-logstash-not-automatically-bind-9200-to-my-es-url/137321)
**Author:** [@magdieldominguez](https://discuss.elastic.co/u/magdieldominguez)\ **Replies:** 2\ **Last updated:** [June 25, 2018, 11:30pm UTC](https://discuss.elastic.co/t/how-do-i-make-logstash-not-automatically-bind-9200-to-my-es-url/137321 "2018-06-25T23:30:21Z")
Hi I am trying to send information into the host url of our elasticsearch db. The problem is that I do not know the port number I just know that it is on http://monitor.production.data.com/elasticsearch but when I put t… --- ## [Slack no longer supports IRC - Best new way to architect integration with Elastic stack?](https://discuss.elastic.co/t/slack-no-longer-supports-irc-best-new-way-to-architect-integration-with-elastic-stack/137323)
**Author:** [@jsachen](https://discuss.elastic.co/u/jsachen)\ **Replies:** 0\ **Last updated:** [June 25, 2018, 11:24pm UTC](https://discuss.elastic.co/t/slack-no-longer-supports-irc-best-new-way-to-architect-integration-with-elastic-stack/137323 "2018-06-25T23:24:01Z")
Since Slack no longer supports IRC, the best tutorials regarding Slack and Elastic integration that I found online are kind of obsolete (this article, for example: https://qbox.io/blog/integrate-slack-elasticsearch-logst… --- ## [Keep only certain line](https://discuss.elastic.co/t/keep-only-certain-line/136996)
**Author:** [@dyl](https://discuss.elastic.co/u/dyl)\ **Replies:** 1\ **Last updated:** [June 25, 2018, 9:57pm UTC](https://discuss.elastic.co/t/keep-only-certain-line/136996 "2018-06-25T21:57:18Z")
Hello, I use filebeat to send files to logstash and then logstash parse them. During the parse, is it possible to do : if \[number\_line != "3" \] { drop { } } To keep only the line 3 of the file ? Thx you --- ## [Can not receive log from remote window machine](https://discuss.elastic.co/t/can-not-receive-log-from-remote-window-machine/136963)
**Author:** [@peterch](https://discuss.elastic.co/u/peterch)\ **Replies:** 1\ **Last updated:** [June 25, 2018, 9:56pm UTC](https://discuss.elastic.co/t/can-not-receive-log-from-remote-window-machine/136963 "2018-06-25T21:56:25Z")
Dear All, I install winlogbeat in a remote window machine but cannot receive log from elk server. I check logstash log find following message. But I can receive other window machine log. May I know why? Thanks \[2018-0… --- ## [Using geoip properly](https://discuss.elastic.co/t/using-geoip-properly/136955)
**Author:** [@PSi\_AU](https://discuss.elastic.co/u/PSi_AU)\ **Replies:** 1\ **Last updated:** [June 25, 2018, 9:55pm UTC](https://discuss.elastic.co/t/using-geoip-properly/136955 "2018-06-25T21:55:15Z")
Hi, I'm using geoip but would like to make sure i'm implementing it correctly. So my config looks like this: filter { geoip { source =\> "ip" database =\> "/usr/share/GeoIP/GeoLite2-City.mmdb" } geoip { source =\> … --- ## [Managing Rotating logs in logstash](https://discuss.elastic.co/t/managing-rotating-logs-in-logstash/137313)
**Author:** [@Hema\_Chandra1](https://discuss.elastic.co/u/Hema_Chandra1)\ **Replies:** 0\ **Last updated:** [June 25, 2018, 7:27pm UTC](https://discuss.elastic.co/t/managing-rotating-logs-in-logstash/137313 "2018-06-25T19:27:45Z")
Hi I have rotating logs i.e. 11 log files each of some fixed size. They are filled from file 1 then 2 then 3 and till 11 after that the new logs overwrites the old logs in file 1. And we are planning to run the logstash… --- ## [Ingesting RDPCoreTS WineventLogs into Elasticsearch](https://discuss.elastic.co/t/ingesting-rdpcorets-wineventlogs-into-elasticsearch/137311)
**Author:** [@LCDI-SOC](https://discuss.elastic.co/u/LCDI-SOC)\ **Replies:** 0\ **Last updated:** [June 25, 2018, 6:59pm UTC](https://discuss.elastic.co/t/ingesting-rdpcorets-wineventlogs-into-elasticsearch/137311 "2018-06-25T18:59:05Z")
Hi everyone. First off, I would just like to thank you for reading this and giving me a hand. We have a small Elastic stack which has been built off of the guides of CyberWardog (Roberto Rodriguez). Below is our curren… --- ## [Logstash output s3 - file naming](https://discuss.elastic.co/t/logstash-output-s3-file-naming/137302)
**Author:** [@Hanciv](https://discuss.elastic.co/u/Hanciv)\ **Replies:** 0\ **Last updated:** [June 25, 2018, 5:30pm UTC](https://discuss.elastic.co/t/logstash-output-s3-file-naming/137302 "2018-06-25T17:30:02Z")
Hi, I am trying to output my logstash event to AWS S3. I want to have my own file naming convention instead of the random one generated by logstash with the patter "ls.s3.xxxx". I explored and I dont see any such option… --- ## [SQL Query to ES via Logstash single run](https://discuss.elastic.co/t/sql-query-to-es-via-logstash-single-run/137294)
**Author:** [@stdev](https://discuss.elastic.co/u/stdev)\ **Replies:** 0\ **Last updated:** [June 25, 2018, 4:46pm UTC](https://discuss.elastic.co/t/sql-query-to-es-via-logstash-single-run/137294 "2018-06-25T16:46:01Z")
Hello, I'm trying to figure out a way to have logstash run a sql query defined in the config file once and load all the data into ES. If I run the query on the cron style schedule (which keeps logstash running) the dat… --- ## [Unabale to star logstash as a service](https://discuss.elastic.co/t/unabale-to-star-logstash-as-a-service/135673)
**Author:** [@Bechir\_Taleb\_Ali](https://discuss.elastic.co/u/Bechir_Taleb_Ali)\ **Replies:** 2\ **Last updated:** [June 25, 2018, 3:05pm UTC](https://discuss.elastic.co/t/unabale-to-star-logstash-as-a-service/135673 "2018-06-25T15:05:31Z")
Hello, My Environement includes: Logstash version: 6.2.4 Operating System : RedHat Entreprise Linux Server release 6.6. I install Logstash form rpm file but while starting the deamon, I get the following error: Does… --- ## [Is it possible to set the MySql Session or Global variable in logstash input configuration file?](https://discuss.elastic.co/t/is-it-possible-to-set-the-mysql-session-or-global-variable-in-logstash-input-configuration-file/137268)
**Author:** [@JoseRohit](https://discuss.elastic.co/u/JoseRohit)\ **Replies:** 0\ **Last updated:** [June 25, 2018, 1:50pm UTC](https://discuss.elastic.co/t/is-it-possible-to-set-the-mysql-session-or-global-variable-in-logstash-input-configuration-file/137268 "2018-06-25T13:50:07Z")
I want to set a MySql session variable through logstash input configuration file. For example : input { jdbc { jdbc\_driver\_library =\> "D:\\logstash\\lib\\mysql-connector-java-5.1.35.jar" jdbc\_driver\_class =\> "com.mysq… --- ## [Remove header from log file](https://discuss.elastic.co/t/remove-header-from-log-file/137240)
**Author:** [@sweta\_khandelwal](https://discuss.elastic.co/u/sweta_khandelwal)\ **Replies:** 8\ **Last updated:** [June 25, 2018, 1:55pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240 "2018-06-25T13:55:24Z")
Hi, Can somebody please check below problem: I have message file in which only one line is there "DateTime,Session,url,errormessage,stacktrace,body". I don't want this line to be indexed in ES. So, I have written belo… --- ## [Blank line in aws name](https://discuss.elastic.co/t/blank-line-in-aws-name/136516)
**Author:** [@Yotam\_Hershkovitz](https://discuss.elastic.co/u/Yotam_Hershkovitz)\ **Replies:** 6\ **Last updated:** [June 25, 2018, 1:09pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516 "2018-06-25T13:09:27Z")
Hi, I'm a bit new to all of this so I hope I'll be clear enough. We're seeing in logstash a blank line as seen in the picture. Even when I export it in raw or formatted the blank line is there with the count. What ca… --- ## [Logstash exits after starting with no error messages](https://discuss.elastic.co/t/logstash-exits-after-starting-with-no-error-messages/136943)
**Author:** [@alilland](https://discuss.elastic.co/u/alilland)\ **Replies:** 3\ **Last updated:** [June 25, 2018, 11:17am UTC](https://discuss.elastic.co/t/logstash-exits-after-starting-with-no-error-messages/136943 "2018-06-25T11:17:18Z")
I am getting a very similar experience that was mentioned here on this post, however, I'm not using Docker, I'm just using a basic .tar and turning logstash on from the command line After having a mixed experience with … --- ## [Logstash 5.2 pipeline settings - path.queue](https://discuss.elastic.co/t/logstash-5-2-pipeline-settings-path-queue/137231)
**Author:** [@milkamar](https://discuss.elastic.co/u/milkamar)\ **Replies:** 0\ **Last updated:** [June 25, 2018, 10:40am UTC](https://discuss.elastic.co/t/logstash-5-2-pipeline-settings-path-queue/137231 "2018-06-25T10:40:24Z")
Hi, I have multiple logstashes v5.5.2 deployed on single server. All of them are started by script; with --path.settings parameter, which points to global logstash.yml. By global I mean that there is single logstash.y… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=733) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=735)