# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=772 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 773 --- ## [Getting \_grokparsefailure as a tag](https://discuss.elastic.co/t/getting-grokparsefailure-as-a-tag/127263)
**Author:** [@student](https://discuss.elastic.co/u/student)\ **Replies:** 5\ **Last updated:** [April 25, 2018, 1:43pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-as-a-tag/127263 "2018-04-25T13:43:26Z")
Hi I was just wondering why i keep getting the tag \_grokparsefailure in my syslog messages? \[Capture\] My logstash config file looks like this input { tcp { port =\> 5000 type =\> syslog } udp { port =\>… --- ## [Logstash - Keep it running](https://discuss.elastic.co/t/logstash-keep-it-running/129427)
**Author:** [@Amol\_Hegana](https://discuss.elastic.co/u/Amol_Hegana)\ **Replies:** 2\ **Last updated:** [April 25, 2018, 1:33pm UTC](https://discuss.elastic.co/t/logstash-keep-it-running/129427 "2018-04-25T13:33:42Z")
I have created environment where logstash is taking data from MS SQL server and feeding (output ) it to Elastic. Main reason to use logstash is to keep these both DB in sync. But now as soon as it feeds data into elastic… --- ## [How to find filter for this?](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410)
**Author:** [@SashaAlex](https://discuss.elastic.co/u/SashaAlex)\ **Replies:** 8\ **Last updated:** [April 25, 2018, 12:26pm UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410 "2018-04-25T12:26:24Z")
I have following log message.I don't have any idea how I use logstash filter for this message.can some one help me? Apr 25 05:09:47 52.78.111.182 %DEVICE-6-UNADOPTED: Device('ap3222-E6D67E'/'ap7622'/74-57-F7-E6-D4-7E) a… --- ## [Multiple pipelines with jdbc\_static](https://discuss.elastic.co/t/multiple-pipelines-with-jdbc-static/129482)
**Author:** [@agriffit](https://discuss.elastic.co/u/agriffit)\ **Replies:** 0\ **Last updated:** [April 25, 2018, 12:21pm UTC](https://discuss.elastic.co/t/multiple-pipelines-with-jdbc-static/129482 "2018-04-25T12:21:00Z")
I'm planning to do a simple sqlite lookup using jdbc\_static however I am confused by the documentation regards multiple pipelines. The documentation states that each pipeline will create a unique local instance of the t… --- ## [Logstash - problems with date](https://discuss.elastic.co/t/logstash-problems-with-date/129084)
**Author:** [@piccasso007](https://discuss.elastic.co/u/piccasso007)\ **Replies:** 12\ **Last updated:** [April 25, 2018, 12:00pm UTC](https://discuss.elastic.co/t/logstash-problems-with-date/129084 "2018-04-25T12:00:07Z")
Log example: \[2018-03-28 12:00:21\] Processed: shop\\Export\\Jobs\\ExportOrders \[2018-03-28 12:00:22\] Processed: shop\\Export\\Jobs\\ExportOrders Logstash configuration: input { file { path =\> "path/to/test/file.log" sta… --- ## [Netflow Codec tuning](https://discuss.elastic.co/t/netflow-codec-tuning/129475)
**Author:** [@jlixfeld](https://discuss.elastic.co/u/jlixfeld)\ **Replies:** 0\ **Last updated:** [April 25, 2018, 11:55am UTC](https://discuss.elastic.co/t/netflow-codec-tuning/129475 "2018-04-25T11:55:03Z")
Hi there, I'm referring to the Netflow codec documentation and stuff on github and I have a question about the Usage examples. I'm assuming that the number of workers is expected to correlate 1:1 with the number of CPU… --- ## [Converting strings to integers then manipulating](https://discuss.elastic.co/t/converting-strings-to-integers-then-manipulating/129353)
**Author:** [@sdberts](https://discuss.elastic.co/u/sdberts)\ **Replies:** 6\ **Last updated:** [April 25, 2018, 11:52am UTC](https://discuss.elastic.co/t/converting-strings-to-integers-then-manipulating/129353 "2018-04-25T11:52:30Z")
I have a string coming through in the following format: "Memory Used": "500 MB" "Memory Used": "768 KB" Basically, what I need to do is convert everything into MBs in integer/float format. For the fields containing "… --- ## [Dataparsefailure problem](https://discuss.elastic.co/t/dataparsefailure-problem/129426)
**Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Replies:** 2\ **Last updated:** [April 25, 2018, 11:42am UTC](https://discuss.elastic.co/t/dataparsefailure-problem/129426 "2018-04-25T11:42:23Z")
filter { grok{ match =\> \[ "message","\\s\*(\\\[(?\\[^:\\\]\]\*):(?\\[^\\\]\]\*)\\\])?" \] } if \[key1\]{ if \[key1\]=~ ".\*Float\\b"{ mutate { convert =\> \["value1", "floa… --- ## [Logstash if condition in output not working](https://discuss.elastic.co/t/logstash-if-condition-in-output-not-working/129466)
**Author:** [@jellydragon](https://discuss.elastic.co/u/jellydragon)\ **Replies:** 1\ **Last updated:** [April 25, 2018, 11:31am UTC](https://discuss.elastic.co/t/logstash-if-condition-in-output-not-working/129466 "2018-04-25T11:31:09Z")
Hi, i'm trying to conditionally redirect logs to different outputs based on the presence of the tag "ERROR". Here is the code i'm using: output { if "ERROR" in \[tags\] { kafka { bootstrap\_servers =\> "localhos… --- ## [Offline install of logstash-output-influxdb fails](https://discuss.elastic.co/t/offline-install-of-logstash-output-influxdb-fails/129457)
**Author:** [@kjetilhp](https://discuss.elastic.co/u/kjetilhp)\ **Replies:** 3\ **Last updated:** [April 25, 2018, 10:57am UTC](https://discuss.elastic.co/t/offline-install-of-logstash-output-influxdb-fails/129457 "2018-04-25T10:57:47Z")
Hi, trying to install the influxdb plugin offline after doing the prepare offline pack on a online machine, but it still tries to go online when installing (trying to verify..) I've created an issue on the plugin itself … --- ## [Sidewinder Firewall Syslog](https://discuss.elastic.co/t/sidewinder-firewall-syslog/129387)
**Author:** [@lcguy](https://discuss.elastic.co/u/lcguy)\ **Replies:** 3\ **Last updated:** [April 25, 2018, 10:39am UTC](https://discuss.elastic.co/t/sidewinder-firewall-syslog/129387 "2018-04-25T10:39:22Z")
Hi All, Thanks for helping me sort out my previous issue which is about FortiGate firewall FortiGate Firewall I have another one which is Sidewinder firewall. Can anyone guide me which is the simple way to parse in lo… --- ## [Skip reading historical data in logstash while parsing logs](https://discuss.elastic.co/t/skip-reading-historical-data-in-logstash-while-parsing-logs/129221)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 24\ **Last updated:** [April 25, 2018, 9:58am UTC](https://discuss.elastic.co/t/skip-reading-historical-data-in-logstash-while-parsing-logs/129221 "2018-04-25T09:58:05Z")
Hi i am reading my logs from s3 bucket, bucket contains data from the month of Jan , when i am running my configuration , logstash is reading all historical data , but i want to read only todays data , how can do that,… --- ## [When i upload files to logstash by curl， A lot of things have been added to it](https://discuss.elastic.co/t/when-i-upload-files-to-logstash-by-curl-a-lot-of-things-have-been-added-to-it/129430)
**Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Replies:** 0\ **Last updated:** [April 25, 2018, 8:25am UTC](https://discuss.elastic.co/t/when-i-upload-files-to-logstash-by-curl-a-lot-of-things-have-been-added-to-it/129430 "2018-04-25T08:25:41Z")
http { host =\> "10.234.88.21" port =\> 8080 additional\_codecs =\> {"application/json"=\>"json"} codec=\> multiline{ pattern =\> "^\\\[" negate =\> true what =\> "previous" … --- ## [Logstash with MS SQL server](https://discuss.elastic.co/t/logstash-with-ms-sql-server/129122)
**Author:** [@Amol\_Hegana](https://discuss.elastic.co/u/Amol_Hegana)\ **Replies:** 1\ **Last updated:** [April 25, 2018, 7:25am UTC](https://discuss.elastic.co/t/logstash-with-ms-sql-server/129122 "2018-04-25T07:25:27Z")
I am getting this exception C:\\tools\\Logstash\\logstash-6.2.2\\bin\>logstash -f logstash.conf Java HotSpot(TM) 64-Bit Server VM warning: Option UseParNewGC was deprecated in version 9.0 and will likely be removed in a fut… --- ## [LogStash::ConfigurationError", :message=\>"Expected one of #, {, ,, \] at line](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-at-line/128999)
**Author:** [@binnzafar](https://discuss.elastic.co/u/binnzafar)\ **Replies:** 4\ **Last updated:** [April 25, 2018, 6:35am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-at-line/128999 "2018-04-25T06:35:43Z")
Dear all, i am uploading a csv file with the following code input { file { path =\>"C:/Users/welcome/Dropbox/IT\_Department/ElasticSearchProjects/ResultAnalysis/Data/Semester\*.csv" start\_position =\> "beginning" sinc… --- ## [Logstash stuck midway while processing while running from java](https://discuss.elastic.co/t/logstash-stuck-midway-while-processing-while-running-from-java/124056)
**Author:** [@sunilkumar](https://discuss.elastic.co/u/sunilkumar)\ **Replies:** 2\ **Last updated:** [April 25, 2018, 6:09am UTC](https://discuss.elastic.co/t/logstash-stuck-midway-while-processing-while-running-from-java/124056 "2018-04-25T06:09:12Z")
Logstash stuck at midway while processing a log file only while running from java(This issue doesn't occur when i run the same thing from logstash console) This is my config file input { file { path =\> "D:\\logstash\\l… --- ## [Not able to install x-pack on logstash 6.2.4](https://discuss.elastic.co/t/not-able-to-install-x-pack-on-logstash-6-2-4/129401)
**Author:** [@say2imran](https://discuss.elastic.co/u/say2imran)\ **Replies:** 1\ **Last updated:** [April 25, 2018, 4:16am UTC](https://discuss.elastic.co/t/not-able-to-install-x-pack-on-logstash-6-2-4/129401 "2018-04-25T04:16:02Z")
While installing x-pack on logstash 6.2.4 getting below error: however x-pack got installed on Kibana, elasticsearch.. tried with local file as well.. but didnt work.. ERROR: Unhandled Java exception: Java.lang.Nullp… --- ## [Logstash freezes post update to 6.2.4](https://discuss.elastic.co/t/logstash-freezes-post-update-to-6-2-4/128675)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [April 25, 2018, 1:28am UTC](https://discuss.elastic.co/t/logstash-freezes-post-update-to-6-2-4/128675 "2018-04-25T01:28:21Z")
I am running three logstash instances which were on 6.2.3 version. Today I upgraded all of them to 6.2.4. The update process was smooth on 2 of the instances and no problem was noticed. On the third instance, logstash w… --- ## [Logstash-6.2.4-1 persisted queue hung again](https://discuss.elastic.co/t/logstash-6-2-4-1-persisted-queue-hung-again/129374)
**Author:** [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Replies:** 2\ **Last updated:** [April 25, 2018, 12:40am UTC](https://discuss.elastic.co/t/logstash-6-2-4-1-persisted-queue-hung-again/129374 "2018-04-25T00:40:02Z")
Spent a couple hours looking through the forum. Lots of people talking about persisted queues not processing but have not seen any solutions to troubleshoot. This seems to be a single file that needs to be looked at 559… --- ## [Not able to convert IIS Log Time to Australian Time Zone](https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875)
**Author:** [@Nitin\_G](https://discuss.elastic.co/u/Nitin_G)\ **Replies:** 2\ **Last updated:** [April 24, 2018, 10:44pm UTC](https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875 "2018-04-24T22:44:20Z")
Hi I want to convert the IIS Logs time to Australia/Sydney time. Here is my Config code- grok { match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp} %{IPV4:s-ip} %{WORD:cs-method} %{URIPATH:cs-uri-stem} %{NOTSP… --- ## [Logstash as a windows service](https://discuss.elastic.co/t/logstash-as-a-windows-service/129293)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 1\ **Last updated:** [April 24, 2018, 10:38pm UTC](https://discuss.elastic.co/t/logstash-as-a-windows-service/129293 "2018-04-24T22:38:25Z")
Could someone help me in installing the Logstash CONF file as a windows service, till date we are running with the command prompt, which will stuck quite often. so wanted to have it as windows service and keep running fo… --- ## [Source field parse not working](https://discuss.elastic.co/t/source-field-parse-not-working/128780)
**Author:** [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Replies:** 9\ **Last updated:** [April 24, 2018, 8:54pm UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780 "2018-04-24T20:54:02Z")
Input: "source": "E:\\\\Program Files\\\\GlobalSCAPE\\\\EFT Enterprise\\\\Config\\\\Logs\\\\u\_ex180419.log" Filter: if \[source\] =~ "^.\*u\_ex.\*$" This is not working. Can someone please help me here? --- ## [HTTP Poller not working - No errors](https://discuss.elastic.co/t/http-poller-not-working-no-errors/128213)
**Author:** [@juandanielpujols](https://discuss.elastic.co/u/juandanielpujols)\ **Replies:** 4\ **Last updated:** [April 24, 2018, 8:23pm UTC](https://discuss.elastic.co/t/http-poller-not-working-no-errors/128213 "2018-04-24T20:23:17Z")
Hi, i have the configuration below in my logstash.conf file. But is not working and is not givin any errors. I got a certificate error before that i solved with a jks. Any hints on how can i troubleshoot? NOTE: Is a cont… --- ## [Using wildcarded filenames in the logstash filter section](https://discuss.elastic.co/t/using-wildcarded-filenames-in-the-logstash-filter-section/129356)
**Author:** [@camerodity](https://discuss.elastic.co/u/camerodity)\ **Replies:** 7\ **Last updated:** [April 24, 2018, 7:40pm UTC](https://discuss.elastic.co/t/using-wildcarded-filenames-in-the-logstash-filter-section/129356 "2018-04-24T19:40:24Z")
Is it possible to use wildcarded filenames in the filter plugin section of logstash? For example, I want to index Apache access logs for some of our webapps and since the apache access logs have the date as part of the … --- ## [Logs from different domain not found in Kibana](https://discuss.elastic.co/t/logs-from-different-domain-not-found-in-kibana/129114)
**Author:** [@sub](https://discuss.elastic.co/u/sub)\ **Replies:** 3\ **Last updated:** [April 24, 2018, 6:21pm UTC](https://discuss.elastic.co/t/logs-from-different-domain-not-found-in-kibana/129114 "2018-04-24T18:21:39Z")
Hi guys! As a first point, I'm really new in ELK, and in \*nix stuff also, I'm mostly a windows guy... So this topic is pretty hard for me. But I have an annoying issue with ELK. I have a few windows AD domains, and all… --- ## [Logstash input fails listening IPv6](https://discuss.elastic.co/t/logstash-input-fails-listening-ipv6/122114)
**Author:** [@davama](https://discuss.elastic.co/u/davama)\ **Replies:** 3\ **Last updated:** [April 24, 2018, 5:56pm UTC](https://discuss.elastic.co/t/logstash-input-fails-listening-ipv6/122114 "2018-04-24T17:56:29Z")
Trying to test this project: https://github.com/robcowart/elastiflow Issue: When running logstash version 6.2.2, enabling ipv6 fails but when i enable with version 5.6.8 it passes and pumps data to elasticsearch. Not su… --- ## [Split filter eliminates documents](https://discuss.elastic.co/t/split-filter-eliminates-documents/129332)
**Author:** [@chrigui94](https://discuss.elastic.co/u/chrigui94)\ **Replies:** 1\ **Last updated:** [April 24, 2018, 3:45pm UTC](https://discuss.elastic.co/t/split-filter-eliminates-documents/129332 "2018-04-24T15:45:18Z")
I have a json array like this : "gateways":\[{"a":""},{},{}\] when I use split \> split { \> field =\> "\[gateways\]" \> } it eliminates document which has empty array "gateways":\[\] any help !? --- ## [FortiGate Firewall](https://discuss.elastic.co/t/fortigate-firewall/129245)
**Author:** [@lcguy](https://discuss.elastic.co/u/lcguy)\ **Replies:** 10\ **Last updated:** [April 24, 2018, 3:37pm UTC](https://discuss.elastic.co/t/fortigate-firewall/129245 "2018-04-24T15:37:14Z")
Hi All, I am trying to parse the FortiGate firewall syslog in Logstash and still failing after spending many times. Need your expertise for standard FortiGate syslog logstash config. Here is current config. I'm gettin… --- ## [Multiline codec with http input](https://discuss.elastic.co/t/multiline-codec-with-http-input/129188)
**Author:** [@caljess599](https://discuss.elastic.co/u/caljess599)\ **Replies:** 5\ **Last updated:** [April 24, 2018, 2:50pm UTC](https://discuss.elastic.co/t/multiline-codec-with-http-input/129188 "2018-04-24T14:50:48Z")
Greetings. I'm stumped trying to use a multiline filter (Logstash 5.1) on my data that is coming in via HTTPS POST. I see that the plugin is being registered in the config... \[2018-04-23T21:26:07,256\]\[DEBUG\]\[logstash.p… --- ## [Logstash says ok but nog data in Elastic/Kibana](https://discuss.elastic.co/t/logstash-says-ok-but-nog-data-in-elastic-kibana/129294)
**Author:** [@Qux](https://discuss.elastic.co/u/Qux)\ **Replies:** 4\ **Last updated:** [April 24, 2018, 2:36pm UTC](https://discuss.elastic.co/t/logstash-says-ok-but-nog-data-in-elastic-kibana/129294 "2018-04-24T14:36:58Z")
I\`m having the problem that Logstash reads the config and says oke but doesnt push data to Elastic/Kibana. I have run the ELK stack on local first (windows) and that works perfect, but on my vps it doesnt want to push t… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=771) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=773)