# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=779 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 780 --- ## [Sum of occurrences in multi line log comes in one second](https://discuss.elastic.co/t/sum-of-occurrences-in-multi-line-log-comes-in-one-second/128161)
**Author:** [@MateuszB](https://discuss.elastic.co/u/MateuszB)\ **Replies:** 0\ **Last updated:** [April 16, 2018, 10:06am UTC](https://discuss.elastic.co/t/sum-of-occurrences-in-multi-line-log-comes-in-one-second/128161 "2018-04-16T10:06:56Z")
Hi, I'd like to create a counter that adds another value ("1" or "one") to an existing string. If in my log there are 3 lines with the occurrence of the word 'low', then each time I will increase the variable value '1'.… --- ## [Logstash unistall](https://discuss.elastic.co/t/logstash-unistall/128155)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 0\ **Last updated:** [April 16, 2018, 9:32am UTC](https://discuss.elastic.co/t/logstash-unistall/128155 "2018-04-16T09:32:34Z")
How to unistall logstash from REHL-- red hat sysytem completely. --- ## [Multiple logstash instances getting data from one redis key?](https://discuss.elastic.co/t/multiple-logstash-instances-getting-data-from-one-redis-key/127970)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [April 16, 2018, 9:21am UTC](https://discuss.elastic.co/t/multiple-logstash-instances-getting-data-from-one-redis-key/127970 "2018-04-16T09:21:11Z")
Hi there, I changed my setting from filebeat -\> logstash to filebeat -\> redis -\> multiple logstash. Since we are still in migration from 5.1.2 to 6.2.3 we are running both stacks in parallel. No we noticed that we hav… --- ## [Yet another funky grokparsefailure](https://discuss.elastic.co/t/yet-another-funky-grokparsefailure/124322)
**Author:** [@Fred1](https://discuss.elastic.co/u/Fred1)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 8:53am UTC](https://discuss.elastic.co/t/yet-another-funky-grokparsefailure/124322 "2018-04-16T08:53:37Z")
Hi gang, Completely out of my wits on this one... Here's a log line (NGINX custom format): 13.88.158.6 - - \[14/Mar/2018:00:02:03 +0000\] "GET /issue/wsfed?wa=wsignout1.0 HTTP/1.0" 499 0 "https://msft2017r2-wus2-prd.wha… --- ## [There is no tags in XML](https://discuss.elastic.co/t/there-is-no-tags-in-xml/128124)
**Author:** [@seungtae](https://discuss.elastic.co/u/seungtae)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:23am UTC](https://discuss.elastic.co/t/there-is-no-tags-in-xml/128124 "2018-04-16T08:23:45Z")
Hello. How can I write code in if condition, if there is no tags in XML. For example, my xml source is like this : \ \ **Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Replies:** 10\ **Last updated:** [April 16, 2018, 7:56am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922 "2018-04-16T07:56:35Z") filter { grok{ match =\> \[ "message","\\\[%{TIMESTAMP\_ISO8601:TimeStamp}\\\]" \] } date { match =\> \[ "TimeStamp", "ISO8601" \] target =\> "timest… --- ## [How to split JSON nested arrays?](https://discuss.elastic.co/t/how-to-split-json-nested-arrays/127976)
**Author:** [@MrFrost](https://discuss.elastic.co/u/MrFrost)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 7:15am UTC](https://discuss.elastic.co/t/how-to-split-json-nested-arrays/127976 "2018-04-16T07:15:47Z")
Hello, I have quite a problem in attempt to split tags below is what I have: message: {"fields":{"value":9936},"name":"sqlserver\_performance","tags":{"counter":"Log File(s) Size (KB)","host":"WIN","instance":"Total","… --- ## [Logstash, variable in rest request](https://discuss.elastic.co/t/logstash-variable-in-rest-request/128112)
**Author:** [@wolfik](https://discuss.elastic.co/u/wolfik)\ **Replies:** 0\ **Last updated:** [April 16, 2018, 7:10am UTC](https://discuss.elastic.co/t/logstash-variable-in-rest-request/128112 "2018-04-16T07:10:26Z")
Hi, I need to extract data to elasticsearch by logstash via REST services (Simple GET request). I used Http\_poller which works great, but now I need to add variable as a parameter to the request. http://localhost:808… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/128111)
**Author:** [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\ **Replies:** 0\ **Last updated:** [April 16, 2018, 7:07am UTC](https://discuss.elastic.co/t/multiple-pipelines/128111 "2018-04-16T07:07:29Z")
Hi I am placing all my config files in pipelines.yml now i want each piepline to have a custom log file i used path.logs command but i dont see a log file created any help is appreciated --- ## [Avoiding multiple OR conditions in if statements logstash](https://discuss.elastic.co/t/avoiding-multiple-or-conditions-in-if-statements-logstash/128104)
**Author:** [@Ganesha\_Venkanna](https://discuss.elastic.co/u/Ganesha_Venkanna)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 6:36am UTC](https://discuss.elastic.co/t/avoiding-multiple-or-conditions-in-if-statements-logstash/128104 "2018-04-16T06:36:49Z")
Hi, I am using the below code to parse only required lines from my logfile and ignore the others, though the code is working i want to avoid the multiple OR conditions,can the strings in the OR conditions be read from a… --- ## [Unable to set a boolean plugin property dynamically](https://discuss.elastic.co/t/unable-to-set-a-boolean-plugin-property-dynamically/128061)
**Author:** [@ItamarBenjamin](https://discuss.elastic.co/u/ItamarBenjamin)\ **Replies:** 3\ **Last updated:** [April 16, 2018, 5:54am UTC](https://discuss.elastic.co/t/unable-to-set-a-boolean-plugin-property-dynamically/128061 "2018-04-16T05:54:17Z")
Hi, there's an open issue for this in logstash-output-elasticsearch github (here) but i think it is not a specific plugin bug but logstash bug. In short: if i want to set a boolean property dynamically, i cannot. if i c… --- ## [Logstash reading rate is max 8-9k per second](https://discuss.elastic.co/t/logstash-reading-rate-is-max-8-9k-per-second/127977)
**Author:** [@ashurawat](https://discuss.elastic.co/u/ashurawat)\ **Replies:** 4\ **Last updated:** [April 16, 2018, 5:05am UTC](https://discuss.elastic.co/t/logstash-reading-rate-is-max-8-9k-per-second/127977 "2018-04-16T05:05:57Z")
I am running a filebeat which is sending logs from my server to REDIS. and the data is huge here. But the logstash is not able to read those data very frequently. And because of this speed, logstash taking lot of time to… --- ## [X-PACK can't install with logstash 6.2.3](https://discuss.elastic.co/t/x-pack-cant-install-with-logstash-6-2-3/127711)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 12:44am UTC](https://discuss.elastic.co/t/x-pack-cant-install-with-logstash-6-2-3/127711 "2018-04-16T00:44:39Z")
when install out put . \[root@xxx bin\]# ./logstash-plugin install file:///data/x-pack-6.2.3.zip Installing file: /data/x-pack-6.2.3.zip Invalid date/time in zip entry Invalid date/time in zip entry Invalid date/time in… --- ## [XML filter causing ES mapping issues](https://discuss.elastic.co/t/xml-filter-causing-es-mapping-issues/126367)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 4\ **Last updated:** [April 15, 2018, 10:44pm UTC](https://discuss.elastic.co/t/xml-filter-causing-es-mapping-issues/126367 "2018-04-15T22:44:05Z")
At least, I think that is the problem. I am getting a lot of rejected docs from Elasticsearch, and when I look at the reason in the dead letter queue file, it says "Can't get text on a START\_OBJECT". The only thing I'm … --- ## [XML filter giving comma separated values](https://discuss.elastic.co/t/xml-filter-giving-comma-separated-values/128023)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 1\ **Last updated:** [April 15, 2018, 10:42pm UTC](https://discuss.elastic.co/t/xml-filter-giving-comma-separated-values/128023 "2018-04-15T22:42:22Z")
Has anyone else experienced this? When I specify an xpath like /el1/el2//\*/text() it does get all the text but whenever there are different elements in that path it separates them with commas, so the field it outputs to … --- ## [Unable to import IIS logs into logstash](https://discuss.elastic.co/t/unable-to-import-iis-logs-into-logstash/128060)
**Author:** [@subrato](https://discuss.elastic.co/u/subrato)\ **Replies:** 2\ **Last updated:** [April 15, 2018, 7:05pm UTC](https://discuss.elastic.co/t/unable-to-import-iis-logs-into-logstash/128060 "2018-04-15T19:05:16Z")
I have looked up few older articles on how to get IIS logs into logstash. For now I was going to just put them in a directory and not worry about filebeat. I got a working pattern (used grok debugger to make sure it pars… --- ## [Filter for LibraESVA 4.3](https://discuss.elastic.co/t/filter-for-libraesva-4-3/127985)
**Author:** [@giuliano](https://discuss.elastic.co/u/giuliano)\ **Replies:** 1\ **Last updated:** [April 15, 2018, 5:50pm UTC](https://discuss.elastic.co/t/filter-for-libraesva-4-3/127985 "2018-04-15T17:50:58Z")
Hi all, I use logstash 6.2.3 and I'd like to connect my LibraESVA 4.3 to Logstash, but I don't understand how to setup the filter for this software. Any idea? Thanking in advance. Giuliano \[libra\] --- ## [Geoip does not add "city" field](https://discuss.elastic.co/t/geoip-does-not-add-city-field/128080)
**Author:** [@t03r1cht](https://discuss.elastic.co/u/t03r1cht)\ **Replies:** 1\ **Last updated:** [April 15, 2018, 4:08pm UTC](https://discuss.elastic.co/t/geoip-does-not-add-city-field/128080 "2018-04-15T16:08:36Z")
I'm using the Logstash Geoip plugin to resolve IP addresses to their geo location. It is working, however, it does not include the city in the result. What am I doing wrong? The output looks like this: "geoip": { "c… --- ## [Logstash monitoring and pipelines](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617)
**Author:** [@webrod](https://discuss.elastic.co/u/webrod)\ **Replies:** 7\ **Last updated:** [April 15, 2018, 4:03pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617 "2018-04-15T16:03:41Z")
Hi, I have stopped Filebeat, no logs are pushed anymore. It is confirmed by all screens from logstash monitoring (like logstahs event received rate, or ES indexing rate), they are all set to 0, BUT the 'logstash pipeli… --- ## [Logstash multiple pipelines going into same index](https://discuss.elastic.co/t/logstash-multiple-pipelines-going-into-same-index/128066)
**Author:** [@saargrin](https://discuss.elastic.co/u/saargrin)\ **Replies:** 2\ **Last updated:** [April 15, 2018, 2:08pm UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines-going-into-same-index/128066 "2018-04-15T14:08:35Z")
Hi i'm trying to set up a centralized syslog for multiple log sources so i have a logstash that has two separate inputs and two separate outputs however for some reason the data from one of the inputs ends up in both … --- ## [How to Modify input JSON ie. message and send output to ES](https://discuss.elastic.co/t/how-to-modify-input-json-ie-message-and-send-output-to-es/127902)
**Author:** [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\ **Replies:** 3\ **Last updated:** [April 15, 2018, 1:37pm UTC](https://discuss.elastic.co/t/how-to-modify-input-json-ie-message-and-send-output-to-es/127902 "2018-04-15T13:37:21Z")
message is {'hostName': 'ramesh-nagargoje-dt1', 'bseid': 1234, 'branch': u'rel-29', 'boardName': u'darcy', 'os': u'android' 'logs': '\[2341282.674723\] usb 1-8: USB disconnect, device number 57\\n\[2341288.676677\] usb 1-7: … --- ## [Unable to run logstash 6.2.3 as a service](https://discuss.elastic.co/t/unable-to-run-logstash-6-2-3-as-a-service/128058)
**Author:** [@Ghari](https://discuss.elastic.co/u/Ghari)\ **Replies:** 0\ **Last updated:** [April 14, 2018, 10:28pm UTC](https://discuss.elastic.co/t/unable-to-run-logstash-6-2-3-as-a-service/128058 "2018-04-14T22:28:48Z")
@ubuntu:~$ logstash -V logstash 6.2.3 @ubuntu:~$ groups logstash logstash : logstash adm @ubuntu:~$ cat /etc/logstash/conf.d/01-rsyslog.conf input { tcp { port =\> 12345 codec =\> json } } output { stdout { c… --- ## [Install a logstash-plugin from a local gem repository](https://discuss.elastic.co/t/install-a-logstash-plugin-from-a-local-gem-repository/127586)
**Author:** [@Dee](https://discuss.elastic.co/u/Dee)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 11:33am UTC](https://discuss.elastic.co/t/install-a-logstash-plugin-from-a-local-gem-repository/127586 "2018-04-11T11:33:08Z")
I have a local gem repository which is configured on my host's gem sources. When I run the logstash plugin command to install a plugin, it says that it failed to connect to rubygems.org (which is OK). Is there a way to… --- ## [Date parsing problem](https://discuss.elastic.co/t/date-parsing-problem/128030)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 10\ **Last updated:** [April 14, 2018, 6:55pm UTC](https://discuss.elastic.co/t/date-parsing-problem/128030 "2018-04-14T18:55:32Z")
I don't know why, but the date filter is not parsing the date field and I don't see any error logs regarding it. The docs do have the \_dateparsefailure tag though. My config: xml { source =\> "message" xpath =\> … --- ## [Offline install x-pack on Windows fails Logstash v5.6.8](https://discuss.elastic.co/t/offline-install-x-pack-on-windows-fails-logstash-v5-6-8/125666)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 3\ **Last updated:** [April 14, 2018, 8:43am UTC](https://discuss.elastic.co/t/offline-install-x-pack-on-windows-fails-logstash-v5-6-8/125666 "2018-04-14T08:43:43Z")
I'm trying to install x-pack offline for v.5.6.8 and ran into the following error C:\\ELK\\logstash-5.6.8\\bin\>logstash-plugin install --no-verify c:/ELK/x-pack-5.6.8.zip Installing c:/ELK/x-pack-5.6.8.zip Error Bundler::H… --- ## [Netflow - Ignoring Netflow version v10](https://discuss.elastic.co/t/netflow-ignoring-netflow-version-v10/127767)
**Author:** [@danpoltawski](https://discuss.elastic.co/u/danpoltawski)\ **Replies:** 2\ **Last updated:** [April 14, 2018, 6:55am UTC](https://discuss.elastic.co/t/netflow-ignoring-netflow-version-v10/127767 "2018-04-14T06:55:44Z")
Hi, I've successfully used the logstash netflow module with Netflow v5. But now we want to enable ipfix on our flow exporter and now logstash just reports that it is ignoring netflow v10. Is this just because logstash d… --- ## [Logstash Won't Start after Restart 6.2.2 load error: jopenssl](https://discuss.elastic.co/t/logstash-wont-start-after-restart-6-2-2-load-error-jopenssl/128020)
**Author:** [@devin.ferguson](https://discuss.elastic.co/u/devin.ferguson)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 8:45pm UTC](https://discuss.elastic.co/t/logstash-wont-start-after-restart-6-2-2-load-error-jopenssl/128020 "2018-04-13T20:45:02Z")
Hello all! I am currently working on a test instance of logstash. It has been working fine until recently I did a service logstash restart because I change a configuration file slightly. Since then logstash won't start.… --- ## [Unable to perform offline upgrade of logstash plugins](https://discuss.elastic.co/t/unable-to-perform-offline-upgrade-of-logstash-plugins/127881)
**Author:** [@bwmaas](https://discuss.elastic.co/u/bwmaas)\ **Replies:** 7\ **Last updated:** [April 13, 2018, 8:20pm UTC](https://discuss.elastic.co/t/unable-to-perform-offline-upgrade-of-logstash-plugins/127881 "2018-04-13T20:20:20Z")
I need to upgrade the logstash-input-s3 and logstash-output-s3 plugins on an environment disconnected from the internet. The offline server is running logstash v5.2.2. Per the instructions here I installed logstash v5.2… --- ## [Is Logstash 5.5 compatible with Elasticsearch 6.2?](https://discuss.elastic.co/t/is-logstash-5-5-compatible-with-elasticsearch-6-2/127878)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 6\ **Last updated:** [April 13, 2018, 8:01pm UTC](https://discuss.elastic.co/t/is-logstash-5-5-compatible-with-elasticsearch-6-2/127878 "2018-04-13T20:01:45Z")
Hi, Is it possible to send logs to Elasticsearch 6.2 from Logstash 5.5? When I look at matrix table it says, Elasticsearch 6.2 is compatible only with Logstash 5.6 - 6.2. Does that mean that Logstash 5.5 will not be abl… --- ## [Running multiple endpoints on the same node](https://discuss.elastic.co/t/running-multiple-endpoints-on-the-same-node/127952)
**Author:** [@Ant](https://discuss.elastic.co/u/Ant)\ **Replies:** 3\ **Last updated:** [April 13, 2018, 7:54pm UTC](https://discuss.elastic.co/t/running-multiple-endpoints-on-the-same-node/127952 "2018-04-13T19:54:39Z")
Big picture I want to run atleast 2 nodes, put a load balancer on the front of them and have the requests fire in across the nodes, not sure if there is anything clever I have to do to ensure what I belive is called atle… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=778) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=780)