# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=756 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 757 --- ## [Logstash not able to connect secured (ssl) Elastic search cluster](https://discuss.elastic.co/t/logstash-not-able-to-connect-secured-ssl-elastic-search-cluster/132035)
**Author:** [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Replies:** 10\ **Last updated:** [May 22, 2018, 1:04am UTC](https://discuss.elastic.co/t/logstash-not-able-to-connect-secured-ssl-elastic-search-cluster/132035 "2018-05-22T01:04:40Z")
I have installed Logstash,elasticsearch and kibana in single instance and installed X-pack also for TLS communication. enabled ssl communication in elasticsearch and kibana working good but logstash unable to connect ela… --- ## [Loading astronomical data with Logstash](https://discuss.elastic.co/t/loading-astronomical-data-with-logstash/129959)
**Author:** [@Marcel-Jan](https://discuss.elastic.co/u/Marcel-Jan)\ **Replies:** 7\ **Last updated:** [May 21, 2018, 10:02pm UTC](https://discuss.elastic.co/t/loading-astronomical-data-with-logstash/129959 "2018-05-21T22:02:47Z")
Hi, I've only just done a course on Elasticsearch, Kibana and Logstash. I have a Ubuntu 64-bit in VirtualBox with Elasticsearch 6.2.3 and Logstash And I thought it would be a good idea to do a little project to see what… --- ## [Pull exact data from JSON data](https://discuss.elastic.co/t/pull-exact-data-from-json-data/132699)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 0\ **Last updated:** [May 21, 2018, 9:30pm UTC](https://discuss.elastic.co/t/pull-exact-data-from-json-data/132699 "2018-05-21T21:30:09Z")
Hello, I have a pile of JSON data and I want to extract only specific segments from the data. For instance, I have this entry that has 38 sections all separated by "\\r\\n" and I want to create a filter that only separat… --- ## [Using Datestamp in log](https://discuss.elastic.co/t/using-datestamp-in-log/132683)
**Author:** [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)\ **Replies:** 3\ **Last updated:** [May 21, 2018, 9:18pm UTC](https://discuss.elastic.co/t/using-datestamp-in-log/132683 "2018-05-21T21:18:32Z")
I have logs that are read after the fact and I need to enter them on my timeline as the events occured not as the logs are read by my shippers. Log entries look like this: 2018-05-18 01:07:03 - Nagios XI \[32\] system:lo… --- ## [Filter specific IP-Addresses](https://discuss.elastic.co/t/filter-specific-ip-addresses/132689)
**Author:** [@nin77](https://discuss.elastic.co/u/nin77)\ **Replies:** 1\ **Last updated:** [May 21, 2018, 7:25pm UTC](https://discuss.elastic.co/t/filter-specific-ip-addresses/132689 "2018-05-21T19:25:03Z")
Hey! I got a Web-Interface where the User can add several IP-Addresses which are interested for him, the rest of the lines without that IP-Address should be removed from the log-file. I looked into grok and cidr filter … --- ## [How to access \[0\] element in event array of objects inside of Elasticsearch Script](https://discuss.elastic.co/t/how-to-access-0-element-in-event-array-of-objects-inside-of-elasticsearch-script/132572)
**Author:** [@hacker\_21](https://discuss.elastic.co/u/hacker_21)\ **Replies:** 1\ **Last updated:** [May 21, 2018, 6:35pm UTC](https://discuss.elastic.co/t/how-to-access-0-element-in-event-array-of-objects-inside-of-elasticsearch-script/132572 "2018-05-21T18:35:24Z")
I have an event created like so: event.set("postal\_codes", \[{"zip" =\> event.get("zip"), "city" =\> event.get("city"), "state" =\> event.get("state"), "country" =\> event.get("country"), "freq" =\> event.get("freq"), "locati… --- ## [Accessing Event Metadata inside of Elasticsearch Output Script](https://discuss.elastic.co/t/accessing-event-metadata-inside-of-elasticsearch-output-script/132535)
**Author:** [@hacker\_21](https://discuss.elastic.co/u/hacker_21)\ **Replies:** 1\ **Last updated:** [May 21, 2018, 6:35pm UTC](https://discuss.elastic.co/t/accessing-event-metadata-inside-of-elasticsearch-output-script/132535 "2018-05-21T18:35:05Z")
Using the elasticsearch output module, I have doc\_as\_upsert set to true for many update actions. I'm using the @metadata capability to store the fields which I don't want upserting into ES. However, I'm having trouble … --- ## [Query to Link Server not working, getting a weird error](https://discuss.elastic.co/t/query-to-link-server-not-working-getting-a-weird-error/131080)
**Author:** [@kseth](https://discuss.elastic.co/u/kseth)\ **Replies:** 3\ **Last updated:** [May 21, 2018, 5:50pm UTC](https://discuss.elastic.co/t/query-to-link-server-not-working-getting-a-weird-error/131080 "2018-05-21T17:50:23Z")
Hi, I am running a query that uses link server to get data from MS SQL db (joining with postgres in link server). The query runs fine when I run in MS SQL Server but doesn't work in logstash. I am getting this error: \[… --- ## [How to Insert array of Json to Elasticsearch from Logstash](https://discuss.elastic.co/t/how-to-insert-array-of-json-to-elasticsearch-from-logstash/132635)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 2\ **Last updated:** [May 21, 2018, 4:24pm UTC](https://discuss.elastic.co/t/how-to-insert-array-of-json-to-elasticsearch-from-logstash/132635 "2018-05-21T16:24:28Z")
Hi all, I'm trying to import data from sql server to elasticsearch using logstash and please find attached conf file.I'm not able to add an array toPreformatted text the existing json. This is the configuartion file: … --- ## [GROK Filter problems](https://discuss.elastic.co/t/grok-filter-problems/132650)
**Author:** [@TheOnlyOne](https://discuss.elastic.co/u/TheOnlyOne)\ **Replies:** 1\ **Last updated:** [May 21, 2018, 1:51pm UTC](https://discuss.elastic.co/t/grok-filter-problems/132650 "2018-05-21T13:51:24Z")
Hello, im new on logstash. i use the grok debugger to get extra fields for logstash This is my log: \<14\>May 21 11:01:46 SERVERNAME01 gravityzone: \[aph\] {"computer\_name":"PC1","computer\_fqdn":"PC1.company.com","compute… --- ## [Create different Indices for different filebeat folder location](https://discuss.elastic.co/t/create-different-indices-for-different-filebeat-folder-location/132478)
**Author:** [@SumitV](https://discuss.elastic.co/u/SumitV)\ **Replies:** 2\ **Last updated:** [May 21, 2018, 10:55am UTC](https://discuss.elastic.co/t/create-different-indices-for-different-filebeat-folder-location/132478 "2018-05-21T10:55:09Z")
Hi There, I have different application logs sitting in different folders, for instance ../ABC/.logs ../XYZ/.logs In this case filebeat should take generate events for multiple location and according to these location… --- ## [Logstash Configuration - filepath from remote machine](https://discuss.elastic.co/t/logstash-configuration-filepath-from-remote-machine/132461)
**Author:** [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\ **Replies:** 6\ **Last updated:** [May 21, 2018, 9:21am UTC](https://discuss.elastic.co/t/logstash-configuration-filepath-from-remote-machine/132461 "2018-05-21T09:21:32Z")
Hi, My logstash configuration file contents is shown below: input { file { path =\> \["D:/Sample/\*"\] start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } output { elasticsearch { hosts =\> \["localhos… --- ## [Import txt log data to cluster](https://discuss.elastic.co/t/import-txt-log-data-to-cluster/132611)
**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\ **Replies:** 3\ **Last updated:** [May 21, 2018, 7:23am UTC](https://discuss.elastic.co/t/import-txt-log-data-to-cluster/132611 "2018-05-21T07:23:14Z")
Hello all, I want to import some .TXT log to my elasticsearch cluster via Logstash. my logstash configuration is as follow : please help me how config my logstash and which filter is suitable for this job ? Data Form… --- ## [Logstash - Configuration](https://discuss.elastic.co/t/logstash-configuration/132088)
**Author:** [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)\ **Replies:** 6\ **Last updated:** [May 21, 2018, 6:30am UTC](https://discuss.elastic.co/t/logstash-configuration/132088 "2018-05-21T06:30:10Z")
Hi, I am using elasticsearch, kibana and logstash for log analysis. All are of 6.2.4 versions. My Question is : I have different log files for a different purpose in one folder. Let's say "Sample" folder. Under Samp… --- ## [Java error in logstash](https://discuss.elastic.co/t/java-error-in-logstash/132464)
**Author:** [@Sachchidanand](https://discuss.elastic.co/u/Sachchidanand)\ **Replies:** 2\ **Last updated:** [May 21, 2018, 6:28am UTC](https://discuss.elastic.co/t/java-error-in-logstash/132464 "2018-05-21T06:28:11Z")
I am getting the following error while trying to start logstash ERROR: Failed to load settings file from "path.settings". Aborting... path.setting=/etc/logstash/pipelines.yml, exception=Java::JavaLang::RuntimeException,… --- ## [Geoip filter plugin does not handle spaces in key name](https://discuss.elastic.co/t/geoip-filter-plugin-does-not-handle-spaces-in-key-name/132362)
**Author:** [@VTGuy](https://discuss.elastic.co/u/VTGuy)\ **Replies:** 4\ **Last updated:** [May 20, 2018, 6:14pm UTC](https://discuss.elastic.co/t/geoip-filter-plugin-does-not-handle-spaces-in-key-name/132362 "2018-05-20T18:14:24Z")
Good day, New user here... I hope I am posting to the correct place. I wanted to report a bug in the Geoip filter plugin. It appears that it does not like a space in the key name. Results in a \_geoip\_lookup\_failure: … --- ## [Logstash not working with allow\_time\_override and getting data loss influxdb](https://discuss.elastic.co/t/logstash-not-working-with-allow-time-override-and-getting-data-loss-influxdb/132488)
**Author:** [@Muktesh\_Kumar](https://discuss.elastic.co/u/Muktesh_Kumar)\ **Replies:** 1\ **Last updated:** [May 20, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-not-working-with-allow-time-override-and-getting-data-loss-influxdb/132488 "2018-05-20T11:29:12Z")
I am facing data loss issue with logstash version 5.2 with influxdb output pluggin. My logstash configs are: filter { grok { patterns\_dir =\> \["/etc/logstash/patterns"\] match =\> … --- ## [Control config deployment via ui](https://discuss.elastic.co/t/control-config-deployment-via-ui/132586)
**Author:** [@Anton\_Putau](https://discuss.elastic.co/u/Anton_Putau)\ **Replies:** 1\ **Last updated:** [May 20, 2018, 9:02am UTC](https://discuss.elastic.co/t/control-config-deployment-via-ui/132586 "2018-05-20T09:02:56Z")
Can I simplify the process of adding new configs to logstash using ui ? Currently I am starting it with necessary config parameters like // bin/logstash \[options\]. I would like to have ability upload new config files v… --- ## [Elastic (ELK) Stack Grok Filter Cluelessness](https://discuss.elastic.co/t/elastic-elk-stack-grok-filter-cluelessness/132520)
**Author:** [@MeeHoyMinoy](https://discuss.elastic.co/u/MeeHoyMinoy)\ **Replies:** 1\ **Last updated:** [May 20, 2018, 8:59am UTC](https://discuss.elastic.co/t/elastic-elk-stack-grok-filter-cluelessness/132520 "2018-05-20T08:59:25Z")
I am new to the Elastic Stack and just installed and configured ELK 6.2.4. I send logs via filebeat and winlogbeat to Logstash, which is supposed to parse the logs via grok into seperate fields and hand them over to elas… --- ## [Decoding gzip response body from Packetbeat](https://discuss.elastic.co/t/decoding-gzip-response-body-from-packetbeat/132579)
**Author:** [@lusid](https://discuss.elastic.co/u/lusid)\ **Replies:** 0\ **Last updated:** [May 19, 2018, 8:40pm UTC](https://discuss.elastic.co/t/decoding-gzip-response-body-from-packetbeat/132579 "2018-05-19T20:40:11Z")
Hello everyone, This has been driving me crazy lately, so any help that can be provided would be HUGELY appreciated. I am using Packetbeat to monitor the requests/responses into/out of Elasticsearch client nodes using … --- ## [Syslog not working](https://discuss.elastic.co/t/syslog-not-working/131950)
**Author:** [@TheOnlyOne](https://discuss.elastic.co/u/TheOnlyOne)\ **Replies:** 13\ **Last updated:** [May 19, 2018, 6:53pm UTC](https://discuss.elastic.co/t/syslog-not-working/131950 "2018-05-19T18:53:09Z")
Hello, i get no logs from syslog 2 different syslog server first i have try with Port 514, but this port is not allowed then i will switch to port 5044 (high port). ive got this error message in logstash.log \[2018-05-… --- ## [How to change Date format from YYYY-MM-DD to DD/MMM/YYYY](https://discuss.elastic.co/t/how-to-change-date-format-from-yyyy-mm-dd-to-dd-mmm-yyyy/132569)
**Author:** [@ThiruG](https://discuss.elastic.co/u/ThiruG)\ **Replies:** 1\ **Last updated:** [May 19, 2018, 2:40pm UTC](https://discuss.elastic.co/t/how-to-change-date-format-from-yyyy-mm-dd-to-dd-mmm-yyyy/132569 "2018-05-19T14:40:54Z")
Hi, To Monitor a application through logstash, i need to change format of data field from YYYY-MM-DD (2018-05-19) to DD/MMM/YYYY (19/May/2018) please suggest how to achive it. --- ## [Logstash 6 config](https://discuss.elastic.co/t/logstash-6-config/132104)
**Author:** [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)\ **Replies:** 2\ **Last updated:** [May 19, 2018, 5:13am UTC](https://discuss.elastic.co/t/logstash-6-config/132104 "2018-05-19T05:13:33Z")
i install logstash from logstash.gz my question is where i set my input, filter and output file? and also how can restart logstash for set my config file? --- ## [Ingest SQL relationships as nested documents](https://discuss.elastic.co/t/ingest-sql-relationships-as-nested-documents/131645)
**Author:** [@mwmouawad](https://discuss.elastic.co/u/mwmouawad)\ **Replies:** 3\ **Last updated:** [May 18, 2018, 11:26pm UTC](https://discuss.elastic.co/t/ingest-sql-relationships-as-nested-documents/131645 "2018-05-18T23:26:38Z")
Hi everyone, I’m trying to figure out a way to index my Postgres data into elasticsearch. I have a user table, and a purchase table with a user\_id column linking to a user. I want to have a elasticsearch document for eac… --- ## [Logstash.pipeline error in dns plugin crashes logstash](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981)
**Author:** [@maxf](https://discuss.elastic.co/u/maxf)\ **Replies:** 6\ **Last updated:** [May 18, 2018, 8:45pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981 "2018-05-18T20:45:08Z")
Hello. I catch this issue 2nd time: DNS plugin crashes logstash (logstash service stay active, but do nothing untill restart) In logstash log there is much errors like \[ERROR\]\[logstash.filters.dns \] DNS: timeout … --- ## [Logstash generating exception in pipelineworker](https://discuss.elastic.co/t/logstash-generating-exception-in-pipelineworker/132527)
**Author:** [@imortalsolitude](https://discuss.elastic.co/u/imortalsolitude)\ **Replies:** 1\ **Last updated:** [May 18, 2018, 6:48pm UTC](https://discuss.elastic.co/t/logstash-generating-exception-in-pipelineworker/132527 "2018-05-18T18:48:04Z")
Hi , When i run the logstash after upgrading it to 6.2.4, it is generating error as the below. Can i please know whether the error is due to the wrong filter or deprecated syntax in the filter configuration the same con… --- ## [LogStash::ConfigurationError](https://discuss.elastic.co/t/logstash-configurationerror/132521)
**Author:** [@format.guardian](https://discuss.elastic.co/u/format.guardian)\ **Replies:** 1\ **Last updated:** [May 18, 2018, 5:45pm UTC](https://discuss.elastic.co/t/logstash-configurationerror/132521 "2018-05-18T17:45:40Z")
Hello, I'm new to ELK and I'm attempting to start logstash with a custom logstash.conf file, when I run the command jadmin@elastic-server:/usr/share/logstash$ sudo bin/logstash -f /etc/logstash/conf.d/logstash.conf I… --- ## [Null aggregation response from logstash elastic search filter while in Kibana its good](https://discuss.elastic.co/t/null-aggregation-response-from-logstash-elastic-search-filter-while-in-kibana-its-good/132511)
**Author:** [@UdaySingh\_Ghadage](https://discuss.elastic.co/u/UdaySingh_Ghadage)\ **Replies:** 0\ **Last updated:** [May 18, 2018, 3:58pm UTC](https://discuss.elastic.co/t/null-aggregation-response-from-logstash-elastic-search-filter-while-in-kibana-its-good/132511 "2018-05-18T15:58:39Z")
Hi, I am running below query from Kibana (6.0.0) and its showing result but same when I am running through logstash Elastic search filter plug in query dsl template json its not returning any result. Query.DSL: { "si… --- ## [FATAL error when stdout output plugin is used](https://discuss.elastic.co/t/fatal-error-when-stdout-output-plugin-is-used/132129)
**Author:** [@auffret](https://discuss.elastic.co/u/auffret)\ **Replies:** 2\ **Last updated:** [May 18, 2018, 2:58pm UTC](https://discuss.elastic.co/t/fatal-error-when-stdout-output-plugin-is-used/132129 "2018-05-18T14:58:26Z")
The stdout output plugin : output { stdout { codec =\> rubydebug } } write informations on the console from which the logstash agent has been started (even in background). But, when there is not console yet, the fo… --- ## [Logstash to Splunk HTTP Event Collector](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765)
**Author:** [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)\ **Replies:** 3\ **Last updated:** [May 9, 2018, 4:13pm UTC](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765 "2018-05-09T16:13:13Z")
I'm trying to use logstash to send data directly to an http event collector (HEC). The HEC collector accepts the following correctly. But I'm trying to translate the to the appropriate HTTP Output config for logstash. … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=755) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=757)