# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=773 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 774 --- ## [Character encoding problems](https://discuss.elastic.co/t/character-encoding-problems/126714)
**Author:** [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Replies:** 10\ **Last updated:** [April 24, 2018, 1:50pm UTC](https://discuss.elastic.co/t/character-encoding-problems/126714 "2018-04-24T13:50:19Z")
Hello and thank you in advance for your help. I can't seem to get the UTF-8 encoding for my logstash output right. It always looks like UTF-8 data has been interpreted as ISO-8859-1. My data sources have been a MySQL da… --- ## [How to call a store proc with parameters via JBDC input plugin on Logstash?](https://discuss.elastic.co/t/how-to-call-a-store-proc-with-parameters-via-jbdc-input-plugin-on-logstash/129268)
**Author:** [@Achilles\_Ka](https://discuss.elastic.co/u/Achilles_Ka)\ **Replies:** 2\ **Last updated:** [April 24, 2018, 2:25pm UTC](https://discuss.elastic.co/t/how-to-call-a-store-proc-with-parameters-via-jbdc-input-plugin-on-logstash/129268 "2018-04-24T14:25:38Z")
Hi all, Is there any example of how to call a store proc with parameters for SQL Server via JDBC plugin? I tried a couple of different implementations using "statement\_filepath" as well as "statement" properties but no… --- ## [In logstash can we have multiple inputs and combine the result set and process the combined data to one output?](https://discuss.elastic.co/t/in-logstash-can-we-have-multiple-inputs-and-combine-the-result-set-and-process-the-combined-data-to-one-output/129281)
**Author:** [@manjur](https://discuss.elastic.co/u/manjur)\ **Replies:** 9\ **Last updated:** [April 24, 2018, 1:11pm UTC](https://discuss.elastic.co/t/in-logstash-can-we-have-multiple-inputs-and-combine-the-result-set-and-process-the-combined-data-to-one-output/129281 "2018-04-24T13:11:40Z")
Hi , I am using a config file like below. In the input section I am pulling the data from different database. I want to perform join and combine results in filter section. basically I just want to merge the result se… --- ## [Logstash crash on netflow input packet](https://discuss.elastic.co/t/logstash-crash-on-netflow-input-packet/129291)
**Author:** [@geertn444](https://discuss.elastic.co/u/geertn444)\ **Replies:** 0\ **Last updated:** [April 24, 2018, 10:55am UTC](https://discuss.elastic.co/t/logstash-crash-on-netflow-input-packet/129291 "2018-04-24T10:55:19Z")
elasticsearch 6.2.2 netflow codec 3.11.2 logstash 6.2.2 I only see the following log message: https://pastebin.com/4a8Ukc8u --- ## [Rename field with dynamic name](https://discuss.elastic.co/t/rename-field-with-dynamic-name/129273)
**Author:** [@jasonyates](https://discuss.elastic.co/u/jasonyates)\ **Replies:** 2\ **Last updated:** [April 24, 2018, 10:53am UTC](https://discuss.elastic.co/t/rename-field-with-dynamic-name/129273 "2018-04-24T10:53:46Z")
I'm ingesting snmptraps from a Cisco wireless LAN controller and some of the extracted field names have a partially dynamic value. One example is below. I need to rename the field below simply to cLApName as anything af… --- ## [Error Running Logstash in Windows](https://discuss.elastic.co/t/error-running-logstash-in-windows/129270)
**Author:** [@kannanraghupathy](https://discuss.elastic.co/u/kannanraghupathy)\ **Replies:** 0\ **Last updated:** [April 24, 2018, 9:15am UTC](https://discuss.elastic.co/t/error-running-logstash-in-windows/129270 "2018-04-24T09:15:04Z")
Hi, I am getting the following error while I am trying to run Logstash for the first time. I am following the logstash configuration link to do the same (https://www.elastic.co/guide/en/logstash/current/configuration.ht… --- ## [Logstash keeps restarting and load CPU](https://discuss.elastic.co/t/logstash-keeps-restarting-and-load-cpu/129242)
**Author:** [@Tellur](https://discuss.elastic.co/u/Tellur)\ **Replies:** 4\ **Last updated:** [April 24, 2018, 8:04am UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-and-load-cpu/129242 "2018-04-24T08:04:07Z")
Hello! I have CentOS with Logstash + JDBC + Elasticsearch to sync data between MySQL database and Elasticsearch. It works great, but I have noticed that Logstash highly loads CPU. I read all topics here and found that L… --- ## [How to parse this (1524555283.778710) timestamp?](https://discuss.elastic.co/t/how-to-parse-this-1524555283-778710-timestamp/129250)
**Author:** [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\ **Replies:** 3\ **Last updated:** [April 24, 2018, 8:04am UTC](https://discuss.elastic.co/t/how-to-parse-this-1524555283-778710-timestamp/129250 "2018-04-24T08:04:09Z")
Hello Everyone, I have one timestamp like 1524555283.778710. How to parse this timestamp i had tried with following command, date { match =\> \[ "ts", "UNIX" \] } and this one also, if i do this one then its giving d… --- ## [Grok parse failure - Replace timestamp](https://discuss.elastic.co/t/grok-parse-failure-replace-timestamp/128488)
**Author:** [@A.Klos](https://discuss.elastic.co/u/A.Klos)\ **Replies:** 1\ **Last updated:** [April 24, 2018, 7:40am UTC](https://discuss.elastic.co/t/grok-parse-failure-replace-timestamp/128488 "2018-04-24T07:40:27Z")
Hi, I have following Json: { "\_index": "filebeat-my-own-tag-xxx-2018.04.18", "\_type": "doc", "\_id": "saPh12IB-118Ln7atRDd", "\_version": 1, "\_score": null, "\_source": { "host": "hostname.my.domain", "source": "/… --- ## [Run multiples pipelines fail](https://discuss.elastic.co/t/run-multiples-pipelines-fail/129101)
**Author:** [@dyl](https://discuss.elastic.co/u/dyl)\ **Replies:** 8\ **Last updated:** [April 24, 2018, 7:33am UTC](https://discuss.elastic.co/t/run-multiples-pipelines-fail/129101 "2018-04-24T07:33:40Z")
Hello ! I try to run multiples pipelines at the same time but when I run logstash i've got this error : WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can spe… --- ## [Logstash error after upgrade](https://discuss.elastic.co/t/logstash-error-after-upgrade/129243)
**Author:** [@giuliano](https://discuss.elastic.co/u/giuliano)\ **Replies:** 0\ **Last updated:** [April 24, 2018, 7:29am UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade/129243 "2018-04-24T07:29:07Z")
Hi all... I have upgrade 6.2.3 version to 6.2.4 and when I try to start the service I have this message: Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled) Active: active (running) … --- ## [Logstash is not splitting apache log fields](https://discuss.elastic.co/t/logstash-is-not-splitting-apache-log-fields/129197)
**Author:** [@mriggy](https://discuss.elastic.co/u/mriggy)\ **Replies:** 1\ **Last updated:** [April 24, 2018, 6:18am UTC](https://discuss.elastic.co/t/logstash-is-not-splitting-apache-log-fields/129197 "2018-04-24T06:18:35Z")
Hello, I am trying to parse apache access logs and assign a value to each field. The problem is that the whole message goes into the message field instead. Could you please help with parsing. conf file: filter { if … --- ## [Logstash-input-jmx multi hosts](https://discuss.elastic.co/t/logstash-input-jmx-multi-hosts/129100)
**Author:** [@jerrychen](https://discuss.elastic.co/u/jerrychen)\ **Replies:** 1\ **Last updated:** [April 24, 2018, 3:32am UTC](https://discuss.elastic.co/t/logstash-input-jmx-multi-hosts/129100 "2018-04-24T03:32:45Z")
Can I put multi hosts in the Json JMX configuration? such as "host" : "192.168.1.2", "192.168.1.3".. --- ## [Logstash java exception](https://discuss.elastic.co/t/logstash-java-exception/129185)
**Author:** [@jmtrc](https://discuss.elastic.co/u/jmtrc)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 9:19pm UTC](https://discuss.elastic.co/t/logstash-java-exception/129185 "2018-04-23T21:19:06Z")
Gents, any thoughts on this error after an attempt to restart the docker instance running logstash? pipeline files were not updated for a while. docker run -p 0.0.0.0:10514:10514/udp -p 0.0.0.0:13514:13514/udp -e XPACK\_… --- ## [Too many DNS request](https://discuss.elastic.co/t/too-many-dns-request/129170)
**Author:** [@imortalsolitude](https://discuss.elastic.co/u/imortalsolitude)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 8:46pm UTC](https://discuss.elastic.co/t/too-many-dns-request/129170 "2018-04-23T20:46:55Z")
I am running ELK 6.2.3 and with ingest geoip plugin my ELK is sending over 500 DNS requests to 8.8.8.8 per minute this is generating too many log files. If i drop packet on the server itself no data in ingested in to the… --- ## [Cisco TCPDUMP](https://discuss.elastic.co/t/cisco-tcpdump/128841)
**Author:** [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 8:43pm UTC](https://discuss.elastic.co/t/cisco-tcpdump/128841 "2018-04-23T20:43:35Z")
Hi I have this on my logstash.conf input{ file { path =\> "/tmp/tcpdump.out" } } filter{ grok{ match =\> \["message", "%{TIMESTAMP\_ISO8601:timestamp} IP %{IP:srcIP}.%{INT:srcPort} \> %{IP:destIP}.%{INT:destPort}"\] … --- ## [Quick Question on Grok and filtering](https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147)
**Author:** [@F\_Terrie](https://discuss.elastic.co/u/F_Terrie)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 8:42pm UTC](https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147 "2018-04-23T20:42:36Z")
Basically I'm wondering if the below is sound enough to work and if it is efficient to what I need, The three logs I'm currently running through Logstash doesn't have a unique type and only has a unique host value. I wa… --- ## [How to sent Windows Event Logs file to ELK?](https://discuss.elastic.co/t/how-to-sent-windows-event-logs-file-to-elk/129164)
**Author:** [@FIRST\_Souharit](https://discuss.elastic.co/u/FIRST_Souharit)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 8:34pm UTC](https://discuss.elastic.co/t/how-to-sent-windows-event-logs-file-to-elk/129164 "2018-04-23T20:34:20Z")
Hello, I just started ELK and english i suck. but I have an ELK trial project to analyze Windows Event Logs. Now I have installed ELK on Ubuntu Vm. If I want to take the log file example into the logstash for analysis. … --- ## [Is Logstash working?](https://discuss.elastic.co/t/is-logstash-working/129017)
**Author:** [@lowdmt](https://discuss.elastic.co/u/lowdmt)\ **Replies:** 4\ **Last updated:** [April 23, 2018, 7:37pm UTC](https://discuss.elastic.co/t/is-logstash-working/129017 "2018-04-23T19:37:11Z")
Hi, I'm new to ELK and Docker (learning curve). I'm struggling to get data into Elasticsearch. Using a .csv as a test. My docker-compose file: version: '2' services: elasticsearch: build: context: elasticsearch/ … --- ## [Logstash 2.1.3 - how to config retry on failure](https://discuss.elastic.co/t/logstash-2-1-3-how-to-config-retry-on-failure/129165)
**Author:** [@mt.michael](https://discuss.elastic.co/u/mt.michael)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 7:25pm UTC](https://discuss.elastic.co/t/logstash-2-1-3-how-to-config-retry-on-failure/129165 "2018-04-23T19:25:20Z")
I'm using 2.1.3 and got an error on the log saying "Attempted to send a bulk request to Elasticsearch configured at host..... but an error occurred and it failed! Are you sure you can reach elasticsearch from this machi… --- ## [IF geoip.country\_name - country\_name](https://discuss.elastic.co/t/if-geoip-country-name-country-name/129151)
**Author:** [@GlennH](https://discuss.elastic.co/u/GlennH)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 6:37pm UTC](https://discuss.elastic.co/t/if-geoip-country-name-country-name/129151 "2018-04-23T18:37:00Z")
I am trying to create a IF statement using country\_name for an email output although it is not identifying the field. I have tried geoip.country\_name as well. Has anyone used geoip.country\_name to filter in logstash? o… --- ## [Use parsed date/time fields to prepare @timestamp](https://discuss.elastic.co/t/use-parsed-date-time-fields-to-prepare-timestamp/128984)
**Author:** [@Saurabh\_Jinturkar](https://discuss.elastic.co/u/Saurabh_Jinturkar)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 6:34pm UTC](https://discuss.elastic.co/t/use-parsed-date-time-fields-to-prepare-timestamp/128984 "2018-04-23T18:34:30Z")
Hi, I am trying to parse HAProxy logs in Logstash. I am using standard pattern available here to parse the log. Filter is parsing date however, I want to use those fields to create a timestamp for the log. Do I need to… --- ## [Trouble with escaped fields in nested JSON... Causing LogStash Json ParserError: Unrecognized token](https://discuss.elastic.co/t/trouble-with-escaped-fields-in-nested-json-causing-logstash-json-parsererror-unrecognized-token/129125)
**Author:** [@steven-lacher](https://discuss.elastic.co/u/steven-lacher)\ **Replies:** 4\ **Last updated:** [April 23, 2018, 6:21pm UTC](https://discuss.elastic.co/t/trouble-with-escaped-fields-in-nested-json-causing-logstash-json-parsererror-unrecognized-token/129125 "2018-04-23T18:21:05Z")
I'm having trouble parsing nested JSON from events. I'm concerned I'm not dealing with the escaped quotation marks properly, or missing some interim step. Original entry as written to the log {"timeMillis":15242606228… --- ## [Extracting the message and adding new fields dynamically](https://discuss.elastic.co/t/extracting-the-message-and-adding-new-fields-dynamically/126412)
**Author:** [@Santhosh\_ic](https://discuss.elastic.co/u/Santhosh_ic)\ **Replies:** 6\ **Last updated:** [April 23, 2018, 2:44pm UTC](https://discuss.elastic.co/t/extracting-the-message-and-adding-new-fields-dynamically/126412 "2018-04-23T14:44:27Z")
Hi, I have below mentioned log events. From the last part, slog\_message, "GREEDYDATA" in the grok, I would like to match again on that and extract various data out of it. For example, device id's, usernames etc. How ca… --- ## [Want to group "Error message", "cause by" and "exception class" from stack trace](https://discuss.elastic.co/t/want-to-group-error-message-cause-by-and-exception-class-from-stack-trace/129134)
**Author:** [@amankumbare](https://discuss.elastic.co/u/amankumbare)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 2:43pm UTC](https://discuss.elastic.co/t/want-to-group-error-message-cause-by-and-exception-class-from-stack-trace/129134 "2018-04-23T14:43:50Z")
Sample Input data 2016-09-21 09:59:51,577\] ERROR fetching topic metadata for topics \[Set(test)\] from broker \[ArrayBuffer(BrokerEndPoint(2,kafka.example.com,9092), BrokerEndPoint(3,kafka.example.com,9092), BrokerEndPoint… --- ## [Reading mysql database: You have an error in your SQL syntax;](https://discuss.elastic.co/t/reading-mysql-database-you-have-an-error-in-your-sql-syntax/129107)
**Author:** [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\ **Replies:** 5\ **Last updated:** [April 23, 2018, 2:19pm UTC](https://discuss.elastic.co/t/reading-mysql-database-you-have-an-error-in-your-sql-syntax/129107 "2018-04-23T14:19:50Z")
I have a mysql fake database which I would like to read as input to logstash & then send the data to elasticsearch. The database IP, the password, the port, the database and the table are correct As well as the query: … --- ## [Grok pattern match order](https://discuss.elastic.co/t/grok-pattern-match-order/129120)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 2:05pm UTC](https://discuss.elastic.co/t/grok-pattern-match-order/129120 "2018-04-23T14:05:04Z")
Hi all, I've been writing up some grok patterns to match some Cisco FirePower logs however due to the data in the logs, it sometimes matching against other patterns and making results inaccurate. I've got the below con… --- ## [Mapper\_parsing\_exception", "reason"=\>"failed to parse \[severity\]"](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781)
**Author:** [@hobakill](https://discuss.elastic.co/u/hobakill)\ **Replies:** 9\ **Last updated:** [April 23, 2018, 1:03pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781 "2018-04-23T13:03:55Z")
full error: \[2018-04-20T00:33:26,274\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-2018.04.20-ea1", :\_type=\>"doc", :\_r… --- ## [Logstash container: Cannot find jar driver library file for JDBC Input Plugin](https://discuss.elastic.co/t/logstash-container-cannot-find-jar-driver-library-file-for-jdbc-input-plugin/129054)
**Author:** [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 12:48pm UTC](https://discuss.elastic.co/t/logstash-container-cannot-find-jar-driver-library-file-for-jdbc-input-plugin/129054 "2018-04-23T12:48:00Z")
I am using logstash container and I would like to use jdbc input plugin to read a remote mysql database. I can see the plugin installed, root@a547c877b6a4:/# /usr/share/logstash/bin/logstash-plugin list ... logstash-i… --- ## [Filter in filebeat or logstash](https://discuss.elastic.co/t/filter-in-filebeat-or-logstash/129082)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 11:58am UTC](https://discuss.elastic.co/t/filter-in-filebeat-or-logstash/129082 "2018-04-23T11:58:45Z")
HI, Iam using filebeat as log shippper in client machines and Elk is also ready. My filebeat is sending all logs which contain error messsage and success message. How to apply filter to receive only error message. [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=772) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=774)