# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=761 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 762 --- ## [Log event on codec error](https://discuss.elastic.co/t/log-event-on-codec-error/131658)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 0\ **Last updated:** [May 14, 2018, 5:09am UTC](https://discuss.elastic.co/t/log-event-on-codec-error/131658 "2018-05-14T05:09:15Z")
HI All, On a regular basis I am getting this is my logs. \[2018-05-14T07:06:11,026\]\[WARN \]\[logstash.codecs.plain \] Received an event that has a different character encoding than you configured. {:text=\>"z\\xA5\\xAD\\t\\… --- ## [Logstash 6.2.4 failing with template and java error, pls help!](https://discuss.elastic.co/t/logstash-6-2-4-failing-with-template-and-java-error-pls-help/131639)
**Author:** [@August\_rush](https://discuss.elastic.co/u/August_rush)\ **Replies:** 0\ **Last updated:** [May 13, 2018, 11:51pm UTC](https://discuss.elastic.co/t/logstash-6-2-4-failing-with-template-and-java-error-pls-help/131639 "2018-05-13T23:51:48Z")
\[2018-05-13T19:56:11,135\]\[ERROR\]\[logstash.outputs.elasticsearch\] Failed to install template. {:message=\>"Template file '' could not be found!", :class=\>"ArgumentError", :backtrace=\>\["C:/Users/kswat/Downloads/logstash-6.2… --- ## [How to ingest multiple files](https://discuss.elastic.co/t/how-to-ingest-multiple-files/131615)
**Author:** [@akml\_kk](https://discuss.elastic.co/u/akml_kk)\ **Replies:** 2\ **Last updated:** [May 13, 2018, 11:11pm UTC](https://discuss.elastic.co/t/how-to-ingest-multiple-files/131615 "2018-05-13T23:11:27Z")
Hello, I need to ingest multiple files with the same categorty in the {index, document\_type} so i tried to use "\*" to do that but it dosen't work (the pipline is runinng but it dosen't ingest the data). this is my con… --- ## [Logstash not parsing my XML](https://discuss.elastic.co/t/logstash-not-parsing-my-xml/131582)
**Author:** [@harish\_c](https://discuss.elastic.co/u/harish_c)\ **Replies:** 1\ **Last updated:** [May 13, 2018, 8:40pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-my-xml/131582 "2018-05-13T20:40:00Z")
I have been slogging all day to get this to work but no luck yet. There are number of questions with xml and tried every suggestion and it still doesn't. Here's my basic XML: \ … --- ## [Configuring a new environment with Logstash](https://discuss.elastic.co/t/configuring-a-new-environment-with-logstash/131374)
**Author:** [@aadiwarden](https://discuss.elastic.co/u/aadiwarden)\ **Replies:** 4\ **Last updated:** [May 13, 2018, 7:45pm UTC](https://discuss.elastic.co/t/configuring-a-new-environment-with-logstash/131374 "2018-05-13T19:45:11Z")
Hi there, Basically I have an entire product using log4net and I want to start collecting all these logs in a centralized Elasticsearch. I have done a lot of research for the past two weeks and would like your recommend… --- ## [Logstash syslog stops listening without any error](https://discuss.elastic.co/t/logstash-syslog-stops-listening-without-any-error/131620)
**Author:** [@vakitha](https://discuss.elastic.co/u/vakitha)\ **Replies:** 0\ **Last updated:** [May 13, 2018, 1:52pm UTC](https://discuss.elastic.co/t/logstash-syslog-stops-listening-without-any-error/131620 "2018-05-13T13:52:14Z")
Hi I am trying to send syslog from apigee to logstash. Logstash receives the data for sometime and if I try after 10 minutes , it stops listening. I don't see data flowing through the port. It blocks the port is my theo… --- ## [Parsing CSV =\> columns semicolon separated =\> values with commas](https://discuss.elastic.co/t/parsing-csv-columns-semicolon-separated-values-with-commas/131612)
**Author:** [@jiona](https://discuss.elastic.co/u/jiona)\ **Replies:** 3\ **Last updated:** [May 13, 2018, 10:53am UTC](https://discuss.elastic.co/t/parsing-csv-columns-semicolon-separated-values-with-commas/131612 "2018-05-13T10:53:53Z")
Hi all, I am trying to parse a csv files with logstash. The csv contains semicolon separated columns and values contain commas. That's my csv-file: Study number;Series description;Value1;Value2;Value3 5870;Text Inf… --- ## [What is the best way to transfer logs from Syslog server to Logstash?](https://discuss.elastic.co/t/what-is-the-best-way-to-transfer-logs-from-syslog-server-to-logstash/131598)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 0\ **Last updated:** [May 13, 2018, 12:58am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-transfer-logs-from-syslog-server-to-logstash/131598 "2018-05-13T00:58:38Z")
Hi, I am trying to send logs from Syslog server to Logstash. Can someone please say what would be the best way? Using Syslog input plugin or TCP? I am currently using TCP plugin but I feel I am missing nearly 25% logs.… --- ## [Split text field - keep only the second part (noob)](https://discuss.elastic.co/t/split-text-field-keep-only-the-second-part-noob/131556)
**Author:** [@Charalampos](https://discuss.elastic.co/u/Charalampos)\ **Replies:** 2\ **Last updated:** [May 12, 2018, 7:59pm UTC](https://discuss.elastic.co/t/split-text-field-keep-only-the-second-part-noob/131556 "2018-05-12T19:59:14Z")
Hello My text field is in this form AAA\_ΒΒΒ. I used the split filter split =\> \[ "message" , "\_" \] and the result is message AAA, BBB and now I want to delete AAA from message. any ideas? thanks, --- ## [Problem of collecting different types of logs( Netflow + Syslog+ Beats) at the same time with logstash version 6.2](https://discuss.elastic.co/t/problem-of-collecting-different-types-of-logs-netflow-syslog-beats-at-the-same-time-with-logstash-version-6-2/131034)
**Author:** [@Dora](https://discuss.elastic.co/u/Dora)\ **Replies:** 4\ **Last updated:** [May 12, 2018, 7:36pm UTC](https://discuss.elastic.co/t/problem-of-collecting-different-types-of-logs-netflow-syslog-beats-at-the-same-time-with-logstash-version-6-2/131034 "2018-05-12T19:36:01Z")
hello, I installed for the first time elastic stack on centos 7, I want to collect different types of logs (firewalls logs through syslog, and windows logs through winlogbeat) and netflow v9. I managed to collect and v… --- ## [KV Filter usage](https://discuss.elastic.co/t/kv-filter-usage/131564)
**Author:** [@bec33](https://discuss.elastic.co/u/bec33)\ **Replies:** 1\ **Last updated:** [May 12, 2018, 6:16pm UTC](https://discuss.elastic.co/t/kv-filter-usage/131564 "2018-05-12T18:16:17Z")
I am following up on this thread, can you help --- ## [Logstash no start with pipeline.yml](https://discuss.elastic.co/t/logstash-no-start-with-pipeline-yml/131554)
**Author:** [@Vidja\_Prashant](https://discuss.elastic.co/u/Vidja_Prashant)\ **Replies:** 0\ **Last updated:** [May 12, 2018, 5:33am UTC](https://discuss.elastic.co/t/logstash-no-start-with-pipeline-yml/131554 "2018-05-12T05:33:17Z")
Hello, i am getting issue when I am starting logstash with directly read pipeline.yml but when i am starting manually with command /usr/share/logstash/bin/logstash -f logstash.conf then working. i attached error file… --- ## [Can't parse @timestamp](https://discuss.elastic.co/t/cant-parse-timestamp/131522)
**Author:** [@Sergey\_Murashov](https://discuss.elastic.co/u/Sergey_Murashov)\ **Replies:** 1\ **Last updated:** [May 11, 2018, 6:55pm UTC](https://discuss.elastic.co/t/cant-parse-timestamp/131522 "2018-05-11T18:55:33Z")
I get netflow data and I need replace @timestamp to correct. I use this: ruby { code =\> 'event.set("temp", Time.now)' } date { match =\> \[ "temp", "ISO8601" \] target =\> "@timestamp" timezone =\> "Europe/Moscow" } … --- ## [Logstash conditional for nested field](https://discuss.elastic.co/t/logstash-conditional-for-nested-field/131042)
**Author:** [@rmac](https://discuss.elastic.co/u/rmac)\ **Replies:** 2\ **Last updated:** [May 11, 2018, 5:05pm UTC](https://discuss.elastic.co/t/logstash-conditional-for-nested-field/131042 "2018-05-11T17:05:32Z")
I understand in Logstash you can access nested fields, for example like this in a filter block mutate { replace =\> { "timestamp" =\> "%{timestamp} %{\[beat\]\[timezone\]}" } } However I seem to be unable to access the… --- ## [Grok filter for Oracle OSB Server logs](https://discuss.elastic.co/t/grok-filter-for-oracle-osb-server-logs/131318)
**Author:** [@Rakesh\_Js](https://discuss.elastic.co/u/Rakesh_Js)\ **Replies:** 9\ **Last updated:** [May 11, 2018, 5:03pm UTC](https://discuss.elastic.co/t/grok-filter-for-oracle-osb-server-logs/131318 "2018-05-11T17:03:12Z")
Hi Guys, i am new to ELK and have been using it for the past few days. I am using the ELK stack on Docker and the purpose is to monitor the Oracle OSB server logs (Part of Oracle SOA Product Suite) . I have been trying … --- ## [Logstash exits with code 1, docker-compose ELK stack](https://discuss.elastic.co/t/logstash-exits-with-code-1-docker-compose-elk-stack/131225)
**Author:** [@beezel](https://discuss.elastic.co/u/beezel)\ **Replies:** 0\ **Last updated:** [May 9, 2018, 7:37pm UTC](https://discuss.elastic.co/t/logstash-exits-with-code-1-docker-compose-elk-stack/131225 "2018-05-09T19:37:56Z")
Turned out to be an issue on my end, sorry about that. --- ## [Logtash adding filename as index name](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487)
**Author:** [@Dhivya\_Buvanesh](https://discuss.elastic.co/u/Dhivya_Buvanesh)\ **Replies:** 3\ **Last updated:** [May 11, 2018, 4:29pm UTC](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487 "2018-05-11T16:29:17Z")
Hi, I want the "index" name to be my filename when uploading to elastic via Logtash, Searched widely but unable to get a working solution. Need help how we can use the grok to set the index name as per filename I trie… --- ## [Usage of Encrypted Private Keys in Keystore](https://discuss.elastic.co/t/usage-of-encrypted-private-keys-in-keystore/131517)
**Author:** [@zpraxis](https://discuss.elastic.co/u/zpraxis)\ **Replies:** 0\ **Last updated:** [May 11, 2018, 4:20pm UTC](https://discuss.elastic.co/t/usage-of-encrypted-private-keys-in-keystore/131517 "2018-05-11T16:20:45Z")
Hi, Is there a way I can use encrypted private keys inside a keystore? It seems the keystore is the only one that can be password-protected, but private keys need to remain unencrypted. Thanks in advance! --- ## [Loading Elasticsearch via Logstash on large dataset is going very slowly](https://discuss.elastic.co/t/loading-elasticsearch-via-logstash-on-large-dataset-is-going-very-slowly/131489)
**Author:** [@NW7](https://discuss.elastic.co/u/NW7)\ **Replies:** 0\ **Last updated:** [May 11, 2018, 2:36pm UTC](https://discuss.elastic.co/t/loading-elasticsearch-via-logstash-on-large-dataset-is-going-very-slowly/131489 "2018-05-11T14:36:14Z")
I have a large dataset in MySql (around 2.2 million rows) and my importing to Elasticsearch via Logstash works, but now is going incredibly slowly. On my local machine in vagrant instances with 4GB RAM, each, it went re… --- ## [Nested KV Filter in logstash](https://discuss.elastic.co/t/nested-kv-filter-in-logstash/130223)
**Author:** [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\ **Replies:** 3\ **Last updated:** [May 11, 2018, 3:30pm UTC](https://discuss.elastic.co/t/nested-kv-filter-in-logstash/130223 "2018-05-11T15:30:30Z")
Hi, Here is a line from my audit.log file "type=CRED\_DISP msg=audit(1525254633.039:542208): pid=35761 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam\_env,pam\_fprintd acct="root" exe="/usr/bin/sudo… --- ## [Multiple patterns regrouping in one line index](https://discuss.elastic.co/t/multiple-patterns-regrouping-in-one-line-index/131073)
**Author:** [@Hamza\_Dhahri](https://discuss.elastic.co/u/Hamza_Dhahri)\ **Replies:** 17\ **Last updated:** [May 11, 2018, 3:29pm UTC](https://discuss.elastic.co/t/multiple-patterns-regrouping-in-one-line-index/131073 "2018-05-11T15:29:41Z")
\< 2018-02-07T10:42:02,831 \[ ExtractDwhData\] \[INFO \] Solife :: Tools :: DWH :: ITK DWH - version : 2.6.0-SNAPSHOT - build #265 on 2018-01-04 08:22:32 2018-02-07T10:42:02,832 \[ ExtractDwhData\] \[INFO \] Starting DWH Data Ex… --- ## [Systemd kills drip daemon and standby vm](https://discuss.elastic.co/t/systemd-kills-drip-daemon-and-standby-vm/131503)
**Author:** [@robertr](https://discuss.elastic.co/u/robertr)\ **Replies:** 0\ **Last updated:** [May 11, 2018, 3:21pm UTC](https://discuss.elastic.co/t/systemd-kills-drip-daemon-and-standby-vm/131503 "2018-05-11T15:21:37Z")
Hi, Just noticed in my development setup that setting USEDRIP doesn't improve the logstash start time when running logstash as a systemd service. Looking more closely what I notice is that 3 PIDs are completely differe… --- ## [Issue with Logstash](https://discuss.elastic.co/t/issue-with-logstash/131343)
**Author:** [@sandeepnarla22322](https://discuss.elastic.co/u/sandeepnarla22322)\ **Replies:** 6\ **Last updated:** [May 11, 2018, 3:11pm UTC](https://discuss.elastic.co/t/issue-with-logstash/131343 "2018-05-11T15:11:19Z")
usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385\] elasticsearch - retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: \[FORBIDDEN/12/index read-only / al… --- ## [Configuration File Sorting results](https://discuss.elastic.co/t/configuration-file-sorting-results/131499)
**Author:** [@npontes](https://discuss.elastic.co/u/npontes)\ **Replies:** 0\ **Last updated:** [May 11, 2018, 3:07pm UTC](https://discuss.elastic.co/t/configuration-file-sorting-results/131499 "2018-05-11T15:07:58Z")
Hello, I'm new in elastic, I'm currently using Logstash 2.1.1 to retrieve data from ElasticSearch 1.4.4 to a CSV. I'm using the following configuration: input { elasticsearch { hosts =\> "host" index =\> "index" scro… --- ## [Grok multiline coded help](https://discuss.elastic.co/t/grok-multiline-coded-help/131472)
**Author:** [@linto](https://discuss.elastic.co/u/linto)\ **Replies:** 1\ **Last updated:** [May 11, 2018, 2:38pm UTC](https://discuss.elastic.co/t/grok-multiline-coded-help/131472 "2018-05-11T14:38:28Z")
Hi there, Could you please help me to create a logstash grok pattern using multiline codec for parsing cobbler logs? At times, the logs span over multiple lines Sample log: Mon May 7 05:53:49 2018 - DEBUG | get\_item… --- ## [Syslog stream](https://discuss.elastic.co/t/syslog-stream/131425)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 7\ **Last updated:** [May 11, 2018, 12:51pm UTC](https://discuss.elastic.co/t/syslog-stream/131425 "2018-05-11T12:51:00Z")
Hi, I want to know, please, how can I configure Logstash to retrieve a syslog stream directly. --- ## [Logstash advanced pipeline examples](https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389)
**Author:** [@ezmani](https://discuss.elastic.co/u/ezmani)\ **Replies:** 2\ **Last updated:** [May 11, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389 "2018-05-11T11:29:50Z")
Hi there, I am attempting to construct a logstash pipeline managed via kibana (x-pack for logstash) for iis-logs import. I am using elastic's guide to construct my filters. per the documentation I can use regexp: =~… --- ## [Logstash beats input, ssl\_certificate\_authorities usefulness](https://discuss.elastic.co/t/logstash-beats-input-ssl-certificate-authorities-usefulness/130476)
**Author:** [@ypid-geberit](https://discuss.elastic.co/u/ypid-geberit)\ **Replies:** 0\ **Last updated:** [May 3, 2018, 2:23pm UTC](https://discuss.elastic.co/t/logstash-beats-input-ssl-certificate-authorities-usefulness/130476 "2018-05-03T14:23:02Z")
I am wondering if ssl\_certificate\_authorities supports what I am looking for. Short overview, in Logstash (beats) inputs, you can enable normal TLS encryption to prevent wiretapping and to ensure that the (beats) client … --- ## [Logstash-filter-rest POST Request Issue](https://discuss.elastic.co/t/logstash-filter-rest-post-request-issue/131449)
**Author:** [@MariumHassan](https://discuss.elastic.co/u/MariumHassan)\ **Replies:** 1\ **Last updated:** [May 11, 2018, 10:36am UTC](https://discuss.elastic.co/t/logstash-filter-rest-post-request-issue/131449 "2018-05-11T10:36:17Z")
This issue has been resolved. Hi, I have recently installed logstash-filter-rest. Now, I want to send a POST request to my webservice which takes xml body, parses it using JAXB and returns xml but I am having an issue… --- ## [Logstash webhdfs error with kerberos enabled cluster](https://discuss.elastic.co/t/logstash-webhdfs-error-with-kerberos-enabled-cluster/130607)
**Author:** [@Anushke\_Hewawaithara](https://discuss.elastic.co/u/Anushke_Hewawaithara)\ **Replies:** 9\ **Last updated:** [May 11, 2018, 10:25am UTC](https://discuss.elastic.co/t/logstash-webhdfs-error-with-kerberos-enabled-cluster/130607 "2018-05-11T10:25:58Z")
we have logstash pipeline as below to read from kafka topic to webhdfs Input = kafka topic Output = webhdfs I have extracted from source (logstash-6.2.4.tar.gz) and did the testing Our hadoop cluster is kerberos en… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=760) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=762)