# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=754 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 755 --- ## [Converting old logstash file to new syntax](https://discuss.elastic.co/t/converting-old-logstash-file-to-new-syntax/132600)
**Author:** [@arcreigh](https://discuss.elastic.co/u/arcreigh)\ **Replies:** 8\ **Last updated:** [May 24, 2018, 4:30am UTC](https://discuss.elastic.co/t/converting-old-logstash-file-to-new-syntax/132600 "2018-05-24T04:30:13Z")
Hello all! I would like to use the following configuration to parse through my Juniper logs. ## Grok filter SRX ## input { syslog{ host =\> "10.25.2.200" port =\> "10514" type =\> "syslog" } } filter { if \[type\] ==… --- ## [Logstash-plugin list throws an Gemfile error](https://discuss.elastic.co/t/logstash-plugin-list-throws-an-gemfile-error/133065)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [May 24, 2018, 2:23am UTC](https://discuss.elastic.co/t/logstash-plugin-list-throws-an-gemfile-error/133065 "2018-05-24T02:23:10Z")
Hello, I've just updated a logstash instance from 5.6 to 6.2.1 and now when I try to run logstash-plugin list I got the following error: Gem::LoadError: You have already activated jruby-openssl 0.10.0, but your Gemfil… --- ## [Two questions. Can I set condition with elapesd\_time? And according to logdatetime get right day of week?](https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932)
**Author:** [@zxc654951](https://discuss.elastic.co/u/zxc654951)\ **Replies:** 2\ **Last updated:** [May 24, 2018, 1:55am UTC](https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932 "2018-05-24T01:55:40Z")
I can use elapsed filter to create elapesd\_time. Now, I want to create a alert like "V" or "X" if elapsed\_time over 0.01 or not. Can I do that? And I want to get right day of week with %{+E}, but it will reply with ex… --- ## [Redis input wildcard key seems not working](https://discuss.elastic.co/t/redis-input-wildcard-key-seems-not-working/132962)
**Author:** [@KurtLiu](https://discuss.elastic.co/u/KurtLiu)\ **Replies:** 2\ **Last updated:** [May 24, 2018, 1:55am UTC](https://discuss.elastic.co/t/redis-input-wildcard-key-seems-not-working/132962 "2018-05-24T01:55:00Z")
My logstash config file is simple and looks like the below. input { redis { host =\> "localhost" port =\> "6379" key =\> "\*hdb\*" data\_type =\> "list" } } output { elasticsearch { hosts =\> \["localhost:9200"\] index… --- ## [How to decompress gzip field in message](https://discuss.elastic.co/t/how-to-decompress-gzip-field-in-message/132019)
**Author:** [@shell.b2t](https://discuss.elastic.co/u/shell.b2t)\ **Replies:** 2\ **Last updated:** [May 24, 2018, 1:37am UTC](https://discuss.elastic.co/t/how-to-decompress-gzip-field-in-message/132019 "2018-05-24T01:37:51Z")
Hi: i have same problem ,my message as follows: http.request.headers.accept: text/html,application/xhtml+xml,application/xml; http.request.headers.accept-encoding: gzip, deflate http.request.headers.accept-language: z… --- ## [Output to sqs in another account?](https://discuss.elastic.co/t/output-to-sqs-in-another-account/133063)
**Author:** [@snuggie-okta](https://discuss.elastic.co/u/snuggie-okta)\ **Replies:** 0\ **Last updated:** [May 24, 2018, 1:33am UTC](https://discuss.elastic.co/t/output-to-sqs-in-another-account/133063 "2018-05-24T01:33:24Z")
I don't see a configuration option to connect to an SQS queue in another account. The SDK appears to have the ability though: https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/SQS/Client.html#get\_queue\_url-instance\_met… --- ## [Parsing json objects with dynamic key](https://discuss.elastic.co/t/parsing-json-objects-with-dynamic-key/132459)
**Author:** [@nmeaux](https://discuss.elastic.co/u/nmeaux)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 8:12pm UTC](https://discuss.elastic.co/t/parsing-json-objects-with-dynamic-key/132459 "2018-05-23T20:12:32Z")
Hello, I am trying to parse a nested json which have dynamic keys. I am just able for now to extract data from the first json object, i dont understand what is going wrong in my ruby filter. Also in the output the who… --- ## [\_jsonparsefailure when ingesting a lot of files](https://discuss.elastic.co/t/jsonparsefailure-when-ingesting-a-lot-of-files/132537)
**Author:** [@AloysiusParedes](https://discuss.elastic.co/u/AloysiusParedes)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 7:28pm UTC](https://discuss.elastic.co/t/jsonparsefailure-when-ingesting-a-lot-of-files/132537 "2018-05-23T19:28:22Z")
I noticed that some of my files are not being ingested properly with the "\_jsonparsefailure" tag. When I take a look at the message it received, it is indeed receiving only part of the JSON file. I suspect that when Log… --- ## [German Umlauts not shown correctly](https://discuss.elastic.co/t/german-umlauts-not-shown-correctly/133020)
**Author:** [@Tempy](https://discuss.elastic.co/u/Tempy)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 4:31pm UTC](https://discuss.elastic.co/t/german-umlauts-not-shown-correctly/133020 "2018-05-23T16:31:06Z")
Hello. I use Filebeat to send logs to Logstash which forwards them to Elasticsearch and then to Kibana. The logs appearing in Kibana are not presented correctly as certain characters (umlauts) are replaced with a quest… --- ## [Add static data to log](https://discuss.elastic.co/t/add-static-data-to-log/132998)
**Author:** [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 4:26pm UTC](https://discuss.elastic.co/t/add-static-data-to-log/132998 "2018-05-23T16:26:01Z")
Hello guys, i am trying to map my ips with the office name that it belongs. My idea is to have a json or something that i can access with logstash in order to do the mapping to get the data. Is that possible or is any wa… --- ## [Windows 10 logstash config parse error \[Expected one of #, {, } at line 11, column 17 \]](https://discuss.elastic.co/t/windows-10-logstash-config-parse-error-expected-one-of-at-line-11-column-17/133015)
**Author:** [@Manish\_Baphna](https://discuss.elastic.co/u/Manish_Baphna)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 4:09pm UTC](https://discuss.elastic.co/t/windows-10-logstash-config-parse-error-expected-one-of-at-line-11-column-17/133015 "2018-05-23T16:09:28Z")
Hi, While loading a CSV file into logstash, I am seeing error about Config's line#11 ( separator =\> "," ) which looks pretty normal to me. Can someone suggest what's wrong here. Config: input { file { path =\> "c:\\W… --- ## [Correct way to access nested fields in logstash filters](https://discuss.elastic.co/t/correct-way-to-access-nested-fields-in-logstash-filters/133005)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 4:06pm UTC](https://discuss.elastic.co/t/correct-way-to-access-nested-fields-in-logstash-filters/133005 "2018-05-23T16:06:42Z")
Hello, The documentation says that to access nested fields you need to use the format \[parent\]\[child\], but the format \[parent.child\] also works. I started to use \[parent.child\] after some tests on version 5.4 where, fo… --- ## [How to read "true/false" values from a csv-file and parse them to bool datatype](https://discuss.elastic.co/t/how-to-read-true-false-values-from-a-csv-file-and-parse-them-to-bool-datatype/132988)
**Author:** [@magida](https://discuss.elastic.co/u/magida)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 1:52pm UTC](https://discuss.elastic.co/t/how-to-read-true-false-values-from-a-csv-file-and-parse-them-to-bool-datatype/132988 "2018-05-23T13:52:39Z")
Hello, I am currently in the midst of reading a bunch of logfiles in a csv-format using logstash. Now a problem that i've come across which i've tried to solve by myself but failed, is that that when a boolean value is … --- ## [XPack Cannot connect to ES](https://discuss.elastic.co/t/xpack-cannot-connect-to-es/133000)
**Author:** [@damianconnolly](https://discuss.elastic.co/u/damianconnolly)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 1:37pm UTC](https://discuss.elastic.co/t/xpack-cannot-connect-to-es/133000 "2018-05-23T13:37:16Z")
Hi, we are running multiple Logstash Instances on our parser server, running version 6.2.4. Each instance is fed by seperate RabbitMQs, and writes to a different ES index depending on the input source. Because we are ru… --- ## [Logstash - grokparsefailure](https://discuss.elastic.co/t/logstash-grokparsefailure/132644)
**Author:** [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\ **Replies:** 5\ **Last updated:** [May 23, 2018, 1:28pm UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/132644 "2018-05-23T13:28:38Z")
Hi, I am using Logstash 6.2.4 and my system is windows 10. I am getting grokparsefailure when I add TIMESTAMPISO8601 field in grok filter. This is my config file for logstash: input { file { path =\> \["D:/TestLogs/\*… --- ## [:error=\>#\ from logstash v5.5.0](https://discuss.elastic.co/t/error-argumenterror-setting-hasnt-been-registered-from-logstash-v5-5-0/132990)
**Author:** [@gayathri](https://discuss.elastic.co/u/gayathri)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 1:27pm UTC](https://discuss.elastic.co/t/error-argumenterror-setting-hasnt-been-registered-from-logstash-v5-5-0/132990 "2018-05-23T13:27:48Z")
Hi Team, We are getting below error while starting logstash 5.5.0 from bin: \[2018-05-23T05:09:47,737\]\[FATAL\]\[logstash.runner \] An unexpected error occurred! {:error=\>#\ **Author:** [@Suraj\_Sharma1](https://discuss.elastic.co/u/Suraj_Sharma1)\ **Replies:** 8\ **Last updated:** [May 23, 2018, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-data-to-logstash-but-nothing-appears-on-logstash-logs-kibana-elastic-log/132796 "2018-05-23T13:11:07Z") Hi All, Am very new to ELK stack and we are implementing this in our project because of huge efforts involved in debugging and seeing the logs. I have configured the filebeat on one of our servers and configuration goe… --- ## [Can you make sure this path is a logstash config file?](https://discuss.elastic.co/t/can-you-make-sure-this-path-is-a-logstash-config-file/132897)
**Author:** [@cmardonespino](https://discuss.elastic.co/u/cmardonespino)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 1:02pm UTC](https://discuss.elastic.co/t/can-you-make-sure-this-path-is-a-logstash-config-file/132897 "2018-05-23T13:02:57Z")
Hi guys, Im a really novice guy working for first time with Logstash, Elasticsearch and Kibana. I created a logstash.conf file: input{ stdin{} } output{ elasticsearch { hosts =\> \["elasticsearch:9200"\] } } I cre… --- ## [Need help with my Apache2 filter](https://discuss.elastic.co/t/need-help-with-my-apache2-filter/132952)
**Author:** [@kyuubi](https://discuss.elastic.co/u/kyuubi)\ **Replies:** 0\ **Last updated:** [May 23, 2018, 8:48am UTC](https://discuss.elastic.co/t/need-help-with-my-apache2-filter/132952 "2018-05-23T08:48:48Z")
In my set-up I have 2 different servers. The first has Filebeat and the second one has Elasticsearch, Kibana and Logstash installed. I have apache2.yml in /etc/filebeat/modules.d enabled. In my filebeat.yml in /etc/fil… --- ## [Logstash-6.2.4 Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting](https://discuss.elastic.co/t/logstash-6-2-4-logstash-could-not-be-started-because-there-is-already-another-instance-using-the-configured-data-directory-if-you-wish-to-run-multiple-instances-you-must-change-the-path-data-setting/132963)
**Author:** [@Vadim\_Klimenko](https://discuss.elastic.co/u/Vadim_Klimenko)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 10:04am UTC](https://discuss.elastic.co/t/logstash-6-2-4-logstash-could-not-be-started-because-there-is-already-another-instance-using-the-configured-data-directory-if-you-wish-to-run-multiple-instances-you-must-change-the-path-data-setting/132963 "2018-05-23T10:04:31Z")
I start Logstash: bin/logstash -f logstash-simple.conf Sending Logstash's logs to /home/vadim/www/FULL/Search/logstash-6.2.4/logs which is now configured via log4j2.properties \[2018-05-23T12:24:31,891\]\[INFO \]\[logstash… --- ## [Convert event to java JsonNode?](https://discuss.elastic.co/t/convert-event-to-java-jsonnode/132969)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [May 23, 2018, 9:50am UTC](https://discuss.elastic.co/t/convert-event-to-java-jsonnode/132969 "2018-05-23T09:50:55Z")
In a plugin, I would like to convert event data to java JsonNode. (I am currently doing event.to\_json and parsing via Java). --- ## [Cloudwatch input plugin- No Metrics to Query](https://discuss.elastic.co/t/cloudwatch-input-plugin-no-metrics-to-query/130782)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 9:12am UTC](https://discuss.elastic.co/t/cloudwatch-input-plugin-no-metrics-to-query/130782 "2018-05-23T09:12:59Z")
Hello Team I'm using Logstash-Cloudwatch-input-Plugin. But I'm getting an error. Please do suggest whats's wrong in my Configuration. Here is Logstash.conf file input { cloudwatch { namespace =\> "AWS/EC2" … --- ## [Logstasth pippeline error](https://discuss.elastic.co/t/logstasth-pippeline-error/132737)
**Author:** [@Marko\_Kevin\_Grilc](https://discuss.elastic.co/u/Marko_Kevin_Grilc)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 8:04am UTC](https://discuss.elastic.co/t/logstasth-pippeline-error/132737 "2018-05-23T08:04:27Z")
Logstash wont allow me to create a pipeline with my config, between him and search. I wanted to import some data into the db, but had no luck. Here's my config Blockquote input{ file{ path=\>"E:\\Programi\\Elastic\\Ser… --- ## [Websphere multiline logs](https://discuss.elastic.co/t/websphere-multiline-logs/132923)
**Author:** [@Saketh\_Chandra\_Kolis](https://discuss.elastic.co/u/Saketh_Chandra_Kolis)\ **Replies:** 8\ **Last updated:** [May 23, 2018, 7:03am UTC](https://discuss.elastic.co/t/websphere-multiline-logs/132923 "2018-05-23T07:03:43Z")
This is what my log file looks like: \[3/12/18 5:28:05:364 EDT\] 00000056 AutowiredAnno I org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor JSR-330 'javax.inject.Inject' annotation found a… --- ## [@ not recognized as ....command](https://discuss.elastic.co/t/not-recognized-as-command/131112)
**Author:** [@Pba1211](https://discuss.elastic.co/u/Pba1211)\ **Replies:** 14\ **Last updated:** [May 23, 2018, 6:23am UTC](https://discuss.elastic.co/t/not-recognized-as-command/131112 "2018-05-23T06:23:24Z")
Hello, After Installing Logstash i tried to run logstash.bat. It returns with a error telling me: C:\\Elastic\_demo\\Logstash\\bin\>logstash.bat '■@' is not recognized as an internal or external command, operable program… --- ## [Logstash - Parsing Log Messages](https://discuss.elastic.co/t/logstash-parsing-log-messages/132630)
**Author:** [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\ **Replies:** 5\ **Last updated:** [May 23, 2018, 6:00am UTC](https://discuss.elastic.co/t/logstash-parsing-log-messages/132630 "2018-05-23T06:00:38Z")
Hi, I have a log file which contains a timestamp and logs message as shown below: I need one multiple pattern such that if the line does not start with the timestamp it should be joined with the preceding line. Can any… --- ## [Multiple logstash nodes and redis cluster](https://discuss.elastic.co/t/multiple-logstash-nodes-and-redis-cluster/132866)
**Author:** [@wanexa](https://discuss.elastic.co/u/wanexa)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 5:57am UTC](https://discuss.elastic.co/t/multiple-logstash-nodes-and-redis-cluster/132866 "2018-05-23T05:57:14Z")
Hi I set up two logstash's server and a redis cluster, so I try to figure out how logstash can send only one time the information to the elastic server. The configuration on the logstash server is the same ::input { r… --- ## [XML Plugin - How to make an attribute filed a key](https://discuss.elastic.co/t/xml-plugin-how-to-make-an-attribute-filed-a-key/132915)
**Author:** [@iwelch82](https://discuss.elastic.co/u/iwelch82)\ **Replies:** 0\ **Last updated:** [May 23, 2018, 2:38am UTC](https://discuss.elastic.co/t/xml-plugin-how-to-make-an-attribute-filed-a-key/132915 "2018-05-23T02:38:45Z")
I have used Beats and Logstash extensively in the past for shipping and analyzing logs with ES and Kibana. For this project I'm looking at taking XML files from our test system, RobotFramework, and piping them into ES fo… --- ## [How to merge separate date and time to @timestamp](https://discuss.elastic.co/t/how-to-merge-separate-date-and-time-to-timestamp/132545)
**Author:** [@jiona](https://discuss.elastic.co/u/jiona)\ **Replies:** 5\ **Last updated:** [May 23, 2018, 12:05am UTC](https://discuss.elastic.co/t/how-to-merge-separate-date-and-time-to-timestamp/132545 "2018-05-23T00:05:27Z")
Hi all. I parse a csv with date and time events. These events has no syslogtime. They are separated in to date and time. How can I merge date and time to the @timestamp? I tried some samples with "mutate" and "date" … --- ## [Issue parsing sudo messages with grok](https://discuss.elastic.co/t/issue-parsing-sudo-messages-with-grok/132898)
**Author:** [@killbartonking](https://discuss.elastic.co/u/killbartonking)\ **Replies:** 0\ **Last updated:** [May 22, 2018, 10:11pm UTC](https://discuss.elastic.co/t/issue-parsing-sudo-messages-with-grok/132898 "2018-05-22T22:11:32Z")
i'm trying to match sudo log messages in syslog, but i'm having issues with the filter i've written- on a failure, it matches every field properly, but on a success, it only matches up to TTY=. the filter: (\<%{POSINT:s… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=753) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=755)