# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=776 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 777 --- ## [Logstash port dependency](https://discuss.elastic.co/t/logstash-port-dependency/128551)
**Author:** [@Jinu\_Prabhakar](https://discuss.elastic.co/u/Jinu_Prabhakar)\ **Replies:** 1\ **Last updated:** [April 19, 2018, 6:22am UTC](https://discuss.elastic.co/t/logstash-port-dependency/128551 "2018-04-19T06:22:47Z")
I am trying to use tcp as well as beats in my logstash.conf by enabling the same port,is it make any problem for filebeat to ship the logs if i didnt use port as 5044. is there any concept in logstash like default por… --- ## [Logsash-plugin command error](https://discuss.elastic.co/t/logsash-plugin-command-error/128342)
**Author:** [@upchair](https://discuss.elastic.co/u/upchair)\ **Replies:** 1\ **Last updated:** [April 19, 2018, 6:19am UTC](https://discuss.elastic.co/t/logsash-plugin-command-error/128342 "2018-04-19T06:19:48Z")
Hello, Please I have a problem with the logstash-plugin command. I have not been able to use it at all since I installed it. As a result I have not been able to install any plugin at all. I would like to install the PL… --- ## [Sql insert](https://discuss.elastic.co/t/sql-insert/128270)
**Author:** [@seungtae](https://discuss.elastic.co/u/seungtae)\ **Replies:** 1\ **Last updated:** [April 19, 2018, 6:16am UTC](https://discuss.elastic.co/t/sql-insert/128270 "2018-04-19T06:16:17Z")
Anyone knows SQL INSERT ?? my jdbc output config is this : output { if(\[parsedCon\] and \[parsedSr\]){ elasticsearch{ index =\> "parse" hosts =\> "localhost:9200" } } stdo… --- ## [How to Parse syslogs before sending to Kibana using logstash](https://discuss.elastic.co/t/how-to-parse-syslogs-before-sending-to-kibana-using-logstash/128088)
**Author:** [@sahotay](https://discuss.elastic.co/u/sahotay)\ **Replies:** 3\ **Last updated:** [April 19, 2018, 6:08am UTC](https://discuss.elastic.co/t/how-to-parse-syslogs-before-sending-to-kibana-using-logstash/128088 "2018-04-19T06:08:10Z")
Greeting: I'm trying to send syslogs to my elasticsearch by using logstash, My syslogs containers entries like below 1. Apr 15 22:10:23 myubuntuhost Console\[16\]: time="2018-04-15T22:10:23.462460809Z" type="scan\_summary… --- ## [\<13\> added to beginning of message](https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450)
**Author:** [@insomniac](https://discuss.elastic.co/u/insomniac)\ **Replies:** 2\ **Last updated:** [April 19, 2018, 3:15am UTC](https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450 "2018-04-19T03:15:42Z")
I have two very different inputs (syslog & exchange message tracking logs) coming from different servers going into different input/filter/output configs in logstash. Both of these have \<13\> added to the start of each m… --- ## [TCP Plugin Input Permission Denied](https://discuss.elastic.co/t/tcp-plugin-input-permission-denied/127722)
**Author:** [@CDR](https://discuss.elastic.co/u/CDR)\ **Replies:** 5\ **Last updated:** [April 19, 2018, 1:15am UTC](https://discuss.elastic.co/t/tcp-plugin-input-permission-denied/127722 "2018-04-19T01:15:41Z")
So I have seen a variety of these errors on the forum but have not really been able to figure this out for my case. I am running Elastic stack on a Linux machine. When I try to start Logstash I get the following logs: \[… --- ## [Remove tab with dissect filter](https://discuss.elastic.co/t/remove-tab-with-dissect-filter/128605)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 9:37pm UTC](https://discuss.elastic.co/t/remove-tab-with-dissect-filter/128605 "2018-04-18T21:37:07Z")
I use dissect plugin for this esample of data file: --- begin file --- 14.76.162.112 # 2018-04-01 --- end file --- With this filter filter { dissect { mapping =\> { "message" =\> "%{… --- ## [Logstash to delete documents in a particular index each time it is run](https://discuss.elastic.co/t/logstash-to-delete-documents-in-a-particular-index-each-time-it-is-run/127264)
**Author:** [@Ongun](https://discuss.elastic.co/u/Ongun)\ **Replies:** 3\ **Last updated:** [April 18, 2018, 9:10pm UTC](https://discuss.elastic.co/t/logstash-to-delete-documents-in-a-particular-index-each-time-it-is-run/127264 "2018-04-18T21:10:55Z")
Hello, Is it possible in Logstash 6.2.2 to delete all the documents in an index when a pipeline is executed? I need this as SQL queries sent via JDBC interface returns data in the following format: Top 5 largest tables… --- ## [SNMP ingested into Logstash is garbled](https://discuss.elastic.co/t/snmp-ingested-into-logstash-is-garbled/125809)
**Author:** [@gbarrett](https://discuss.elastic.co/u/gbarrett)\ **Replies:** 8\ **Last updated:** [April 18, 2018, 7:55pm UTC](https://discuss.elastic.co/t/snmp-ingested-into-logstash-is-garbled/125809 "2018-04-18T19:55:15Z")
I'm having a strange problem ingesting snmp into Logstash. This is my pipeline: input { snmptrap { port =\> 162 type =\> "snmp" } } output { if \[type\] == "snmp" { stdout { codec =\> rubydebug } } } T… --- ## [Creating pattern issue](https://discuss.elastic.co/t/creating-pattern-issue/128559)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 3\ **Last updated:** [April 18, 2018, 7:01pm UTC](https://discuss.elastic.co/t/creating-pattern-issue/128559 "2018-04-18T19:01:27Z")
11 Apr 2018 10:40:11,306 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180411.1015+0100-1030+0100\_15310.xml.gz For this grok pattern is creeating an… --- ## [Parsing and search data in logstash and elasticsearch](https://discuss.elastic.co/t/parsing-and-search-data-in-logstash-and-elasticsearch/127637)
**Author:** [@Mohamed\_Amine\_Bogate](https://discuss.elastic.co/u/Mohamed_Amine_Bogate)\ **Replies:** 6\ **Last updated:** [April 18, 2018, 4:49pm UTC](https://discuss.elastic.co/t/parsing-and-search-data-in-logstash-and-elasticsearch/127637 "2018-04-18T16:49:34Z")
This is an extract of my log file \[30531388\_1972358626168912\_8191993682908413952\_o\] I have parsed it and this is the result json \[30516672\_1972358362835605\_1713377130001203200\_o\] \[30594431\_1972358459502262\_73813397799… --- ## [Error registering plugin {:pipeline\_id=\>".monitoring-logstash"](https://discuss.elastic.co/t/error-registering-plugin-pipeline-id-monitoring-logstash/128575)
**Author:** [@dchan08](https://discuss.elastic.co/u/dchan08)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 4:15pm UTC](https://discuss.elastic.co/t/error-registering-plugin-pipeline-id-monitoring-logstash/128575 "2018-04-18T16:15:05Z")
\[2018-04-18T11:11:16,314\]\[INFO \]\[logstash.pipeline \] Starting pipeline {:pipeline\_id=\>".monitoring-logstash", "pipeline.workers"=\>1, "pipeline.batch.size"=\>2, "pipeline.batch.delay"=\>50} \[2018-04-18T11:11:16,321\]… --- ## [Logstash not allowed to talk with elasticsearch (Manticore::SocketException\]](https://discuss.elastic.co/t/logstash-not-allowed-to-talk-with-elasticsearch-manticore-socketexception/128556)
**Author:** [@skaldenmet](https://discuss.elastic.co/u/skaldenmet)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 3:39pm UTC](https://discuss.elastic.co/t/logstash-not-allowed-to-talk-with-elasticsearch-manticore-socketexception/128556 "2018-04-18T15:39:11Z")
Hi, Im using docker-elk with version 6.2.2 on my 16.04 Ubuntu Server with X-Pack. The issue is when i start my docker containers logstash keeps spamming: \[WARN \]\[logstash.outputs.elasticsearch\] Attempted to resurrect … --- ## [Mutate convert seems not to be working](https://discuss.elastic.co/t/mutate-convert-seems-not-to-be-working/128566)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 3:23pm UTC](https://discuss.elastic.co/t/mutate-convert-seems-not-to-be-working/128566 "2018-04-18T15:23:52Z")
Hi, I had a mutate filter convert some nested fields from string to float. It worked before the last update to 6.2.4 but now it seems to have stopped working. Unfortunately I skipped some versions and don't know anymor… --- ## [Infinite loop when loading data from mongodb to logstash](https://discuss.elastic.co/t/infinite-loop-when-loading-data-from-mongodb-to-logstash/128561)
**Author:** [@rihab](https://discuss.elastic.co/u/rihab)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 3:03pm UTC](https://discuss.elastic.co/t/infinite-loop-when-loading-data-from-mongodb-to-logstash/128561 "2018-04-18T15:03:54Z")
Hello, I try to load data from mongodb to logstash but I have Infinite loop. I use logstash 1.5.4 and mongo db 3.5.1. My logstash configuration : input { mongodb { uri =\> "mongodb://127.0.0.1:27017/logtest" collec… --- ## [Logstash showing error: connect timed out](https://discuss.elastic.co/t/logstash-showing-error-connect-timed-out/128455)
**Author:** [@sarang](https://discuss.elastic.co/u/sarang)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 4:39am UTC](https://discuss.elastic.co/t/logstash-showing-error-connect-timed-out/128455 "2018-04-18T04:39:44Z")
Hi , I want data from table from servicenow(ITSM tool) into elasticsearch. So I am using http\_poller plugin to get the data from servicenow REST API. I am executing command logstash -f D:\\ELK\\Input\\http\_poller.conf: Af… --- ## [Logstash csv filter convert option](https://discuss.elastic.co/t/logstash-csv-filter-convert-option/128374)
**Author:** [@annk](https://discuss.elastic.co/u/annk)\ **Replies:** 2\ **Last updated:** [April 18, 2018, 12:30pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-convert-option/128374 "2018-04-18T12:30:42Z")
Hi, I am trying to add type for my data table columns but it doesnt seem to work. filter { if \[type\] == "statistics" { csv { separator =\> "," columns =\> \["Queue","closed successful","closed unsuccessful","merged","… --- ## [SSL with Filebeat not working](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/128225)
**Author:** [@va1entin](https://discuss.elastic.co/u/va1entin)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 12:23pm UTC](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/128225 "2018-04-18T12:23:46Z")
Hey folks, I tried to get SSL working between Logstash and Filebeat but ran out of ideas now. I have two servers in my test case. Both use self-signed certificates from the same CA. The configs look as follows: Logst… --- ## [Logstatch issue](https://discuss.elastic.co/t/logstatch-issue/128209)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 12:16pm UTC](https://discuss.elastic.co/t/logstatch-issue/128209 "2018-04-18T12:16:31Z")
\[root@ukmr0xtmd01 logstash\]# /usr/share/logstash/bin/logstash --debug -f siae.conf \>\>/home/talend/data/amr.txt WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You ca… --- ## [NullPointerException with mutate \> copy @timestamp](https://discuss.elastic.co/t/nullpointerexception-with-mutate-copy-timestamp/128528)
**Author:** [@cbley](https://discuss.elastic.co/u/cbley)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 11:51am UTC](https://discuss.elastic.co/t/nullpointerexception-with-mutate-copy-timestamp/128528 "2018-04-18T11:51:38Z")
filter { mutate { ( sorry, did not intend to post yet ) --- ## [Sometimes entry is not recognized as a separate entry](https://discuss.elastic.co/t/sometimes-entry-is-not-recognized-as-a-separate-entry/128459)
**Author:** [@prateek\_shrivastava](https://discuss.elastic.co/u/prateek_shrivastava)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 11:14am UTC](https://discuss.elastic.co/t/sometimes-entry-is-not-recognized-as-a-separate-entry/128459 "2018-04-18T11:14:41Z")
I am using C# application and logging through nlog. It is writing in file as well as sending the logs through tcp to logstash. Actual log file is (which is written by nlog in file): 2018-04-18 10:26:51 | \[38\] | ERROR |… --- ## [Where to merge inputs from multiple beat inputs streams](https://discuss.elastic.co/t/where-to-merge-inputs-from-multiple-beat-inputs-streams/128514)
**Author:** [@satyag](https://discuss.elastic.co/u/satyag)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 10:38am UTC](https://discuss.elastic.co/t/where-to-merge-inputs-from-multiple-beat-inputs-streams/128514 "2018-04-18T10:38:05Z")
Is logstash is the right place to merge inputs coming from multiple beats to create maximum allocations and consumption charts? Any examples? --- ## [How to find if grok pattern is matched ot not?](https://discuss.elastic.co/t/how-to-find-if-grok-pattern-is-matched-ot-not/128465)
**Author:** [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\ **Replies:** 4\ **Last updated:** [April 18, 2018, 10:18am UTC](https://discuss.elastic.co/t/how-to-find-if-grok-pattern-is-matched-ot-not/128465 "2018-04-18T10:18:47Z")
Hi, I want to find if grok pattern is matched or not. If pattern is matched then add one new field in given json else ignore to output it . here is my input json { "type": "dmesg", "hostName": "ramesh-nagargoje", "… --- ## [What code should I place into logstash.conf to automatically delete records with certain unique IDs from certain ES index?](https://discuss.elastic.co/t/what-code-should-i-place-into-logstash-conf-to-automatically-delete-records-with-certain-unique-ids-from-certain-es-index/128195)
**Author:** [@Mikhail](https://discuss.elastic.co/u/Mikhail)\ **Replies:** 6\ **Last updated:** [April 18, 2018, 10:13am UTC](https://discuss.elastic.co/t/what-code-should-i-place-into-logstash-conf-to-automatically-delete-records-with-certain-unique-ids-from-certain-es-index/128195 "2018-04-18T10:13:45Z")
Hi, I have an ES index that is filled with data by logstash with use of jdbc driver. Data source is SQL table1. Also, I have a SQL table2 that stores list of IDs that were deleted from SQL table1. And now I want to te… --- ## [Forwarding the field to the next event](https://discuss.elastic.co/t/forwarding-the-field-to-the-next-event/128504)
**Author:** [@MateuszB](https://discuss.elastic.co/u/MateuszB)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 10:04am UTC](https://discuss.elastic.co/t/forwarding-the-field-to-the-next-event/128504 "2018-04-18T10:04:54Z")
Is it possible to pass the field to the next event. My log is multi-line: root: 192.168.1.10|unknown (66/tcp)|92567|Low|description| root: 192.168.1.10|unknown (26/tcp)|92567|Low|description| root: 192.168.1.10|unkn… --- ## [Logstash error " \[ERROR\] 2018-04-18 09:50:58.632 \[\[main\]\ **Author:** [@Roshan\_r](https://discuss.elastic.co/u/Roshan_r)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 9:54am UTC](https://discuss.elastic.co/t/logstash-error-error-2018-04-18-09-50-58-632-main-beats-rejectedexecution-failed-to-submit-a-listener-notification-task-event-loop-shut-down/128500 "2018-04-18T09:54:05Z") I am getting an error while running logstash. \[ERROR\] 2018-04-18 09:50:58.632 \[\[main\]\ l… --- ## [GROK pattern details](https://discuss.elastic.co/t/grok-pattern-details/128498)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 0\ **Last updated:** [April 18, 2018, 9:45am UTC](https://discuss.elastic.co/t/grok-pattern-details/128498 "2018-04-18T09:45:46Z")
how does this pattern works : S3\_REQUEST\_LINE and what it does and it will support in logstash 6.2.3 version --- ## [Fields are not being parsed in new version of kibna](https://discuss.elastic.co/t/fields-are-not-being-parsed-in-new-version-of-kibna/126748)
**Author:** [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\ **Replies:** 20\ **Last updated:** [April 18, 2018, 9:34am UTC](https://discuss.elastic.co/t/fields-are-not-being-parsed-in-new-version-of-kibna/126748 "2018-04-18T09:34:56Z")
Hi fileds such as ApplicationPool , ConnectedServerPort , bytesReceivedFromClient , httpResponse , uriPathWithParam etc are not being segregated, in kibana, due to which we are unable to perform visualizations, based … --- ## [Logging from within Ruby Filter](https://discuss.elastic.co/t/logging-from-within-ruby-filter/127983)
**Author:** [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Replies:** 2\ **Last updated:** [April 18, 2018, 8:44am UTC](https://discuss.elastic.co/t/logging-from-within-ruby-filter/127983 "2018-04-18T08:44:23Z")
Hello, is it possible to write to the logfile of Logstash from within the Rubyfilter? And when yes how? Thanks in advance --- ## [How to use filename as index wiht beats input](https://discuss.elastic.co/t/how-to-use-filename-as-index-wiht-beats-input/128467)
**Author:** [@terminaattori](https://discuss.elastic.co/u/terminaattori)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 8:29am UTC](https://discuss.elastic.co/t/how-to-use-filename-as-index-wiht-beats-input/128467 "2018-04-18T08:29:48Z")
Hey! How can I use the filename as an index when using beats input for multiple files? My filebeat.yml looks currently like this: filebeat.prospectors: - type: log paths: - /path/${CURRENT\_SERVER}/\*log\* fields… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=775) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=777)