# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=781 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 782 --- ## [Accidentally deleted the logstash log in /var/log/logstash/logstash-plain.log. Not getting created on its own](https://discuss.elastic.co/t/accidentally-deleted-the-logstash-log-in-var-log-logstash-logstash-plain-log-not-getting-created-on-its-own/127822)
**Author:** [@Sriram\_Kannan](https://discuss.elastic.co/u/Sriram_Kannan)\ **Replies:** 0\ **Last updated:** [April 12, 2018, 1:07pm UTC](https://discuss.elastic.co/t/accidentally-deleted-the-logstash-log-in-var-log-logstash-logstash-plain-log-not-getting-created-on-its-own/127822 "2018-04-12T13:07:40Z")
Hi, I accidentally deleted the logstash log and restarted the service. The logs are not getting created but the service is running well. Not sure where is it logging. I tried touching the file and assigning the user a… --- ## [After upgrading to logstash6 ruby code stop working](https://discuss.elastic.co/t/after-upgrading-to-logstash6-ruby-code-stop-working/127811)
**Author:** [@yossiv](https://discuss.elastic.co/u/yossiv)\ **Replies:** 2\ **Last updated:** [April 12, 2018, 12:52pm UTC](https://discuss.elastic.co/t/after-upgrading-to-logstash6-ruby-code-stop-working/127811 "2018-04-12T12:52:57Z")
Hi all. i would like to get your help converting my below code to the new ruby code. after i upgraded to logstash6 ( from logstash2) this math function stop working i need to calculate the profit . i know it has chan… --- ## [Sql\_last\_value doesn't refresh](https://discuss.elastic.co/t/sql-last-value-doesnt-refresh/127787)
**Author:** [@woshitom](https://discuss.elastic.co/u/woshitom)\ **Replies:** 1\ **Last updated:** [April 12, 2018, 12:33pm UTC](https://discuss.elastic.co/t/sql-last-value-doesnt-refresh/127787 "2018-04-12T12:33:09Z")
I'm importing data from a postgresql database to elasticsearch using logstash. My input looks like: input { jdbc { jdbc\_connection\_string =\> "\*\*\*" jdbc\_user =\> "\*\*\*" jdbc\_password =\> "\*\*\*" … --- ## [Get started with logstash](https://discuss.elastic.co/t/get-started-with-logstash/127315)
**Author:** [@Ant](https://discuss.elastic.co/u/Ant)\ **Replies:** 4\ **Last updated:** [April 12, 2018, 12:28pm UTC](https://discuss.elastic.co/t/get-started-with-logstash/127315 "2018-04-12T12:28:14Z")
Ive been tasked with implimenting log stash as a means to get data into elastic and while Ive heard the name before I dont really know much more than that about it so to save me making some mistakes in the early stages w… --- ## [Please validate mutiple GROK filter](https://discuss.elastic.co/t/please-validate-mutiple-grok-filter/127738)
**Author:** [@rakeshroshan](https://discuss.elastic.co/u/rakeshroshan)\ **Replies:** 3\ **Last updated:** [April 12, 2018, 12:16pm UTC](https://discuss.elastic.co/t/please-validate-mutiple-grok-filter/127738 "2018-04-12T12:16:33Z")
I Mentioned logstash-simple.conf file. Please validate logstash-simple conf file, whether imultiple GROK filters in correct format or not ? In case if it is wrong please mention the correct format. Thanks in Advance. in… --- ## [Problem with pipeline.yml and netflow](https://discuss.elastic.co/t/problem-with-pipeline-yml-and-netflow/127802)
**Author:** [@Sergey\_Murashov](https://discuss.elastic.co/u/Sergey_Murashov)\ **Replies:** 0\ **Last updated:** [April 12, 2018, 11:12am UTC](https://discuss.elastic.co/t/problem-with-pipeline-yml-and-netflow/127802 "2018-04-12T11:12:28Z")
ELK version - 6.2.2 SG version - 6.2.2-22.0 JVM version - build 1.8.0\_161-b12 I installed the NetFlow module and registered its parameters in logstash.yml: modules: - name: netflow var.elasticsearch.hosts: "logstash… --- ## [SSL between Filebeat and Logstash using .p12](https://discuss.elastic.co/t/ssl-between-filebeat-and-logstash-using-p12/127500)
**Author:** [@jordyd](https://discuss.elastic.co/u/jordyd)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 1:39pm UTC](https://discuss.elastic.co/t/ssl-between-filebeat-and-logstash-using-p12/127500 "2018-04-11T13:39:34Z")
Following the documenation (https://www.elastic.co/guide/en/beats/filebeat/6.1/configuring-ssl-logstash.html) it shows how to configure Filebeat and Logstash. But when reading the documenation for creating certificates u… --- ## [Auto run multiple pipeline config files](https://discuss.elastic.co/t/auto-run-multiple-pipeline-config-files/127790)
**Author:** [@vincent25](https://discuss.elastic.co/u/vincent25)\ **Replies:** 0\ **Last updated:** [April 12, 2018, 10:25am UTC](https://discuss.elastic.co/t/auto-run-multiple-pipeline-config-files/127790 "2018-04-12T10:25:01Z")
Hi, I have multiple pipelines(conf files) for various types of application logs in various folders.My requirement is to keep these pipelines running in the background so that real time,continuous indexes are created for… --- ## [Configure JDBC Input plugin for logstash](https://discuss.elastic.co/t/configure-jdbc-input-plugin-for-logstash/127593)
**Author:** [@pvderivco](https://discuss.elastic.co/u/pvderivco)\ **Replies:** 14\ **Last updated:** [April 12, 2018, 10:25am UTC](https://discuss.elastic.co/t/configure-jdbc-input-plugin-for-logstash/127593 "2018-04-12T10:25:33Z")
I am exploring my knowledge on configuring input plugins to my logstash. I have a docker container with elk running on it. I was successfully able to create metric beats and fetch logs from a REST API and create visualiz… --- ## [Logstash throwing Error while starting](https://discuss.elastic.co/t/logstash-throwing-error-while-starting/127789)
**Author:** [@Roshan\_r](https://discuss.elastic.co/u/Roshan_r)\ **Replies:** 0\ **Last updated:** [April 12, 2018, 10:23am UTC](https://discuss.elastic.co/t/logstash-throwing-error-while-starting/127789 "2018-04-12T10:23:22Z")
I am using beats for the first time. I have been using Heka with Rabbitmq to transfer the logs to logstash. Now, i have beats in one server and transferring logs to logstash in another server \[ Not sure whether logs are … --- ## [How to use multiple filters and multiple Grok filters](https://discuss.elastic.co/t/how-to-use-multiple-filters-and-multiple-grok-filters/127723)
**Author:** [@rakeshroshan](https://discuss.elastic.co/u/rakeshroshan)\ **Replies:** 4\ **Last updated:** [April 12, 2018, 8:37am UTC](https://discuss.elastic.co/t/how-to-use-multiple-filters-and-multiple-grok-filters/127723 "2018-04-12T08:37:52Z")
Before adding filter it works fine. But after adding filter, it is not working fine. It is showing an exception. I mentioned that logstash-simple config file below. Actually i want to use multiple grok filter. How t… --- ## [Create multiple groks for different logs](https://discuss.elastic.co/t/create-multiple-groks-for-different-logs/127623)
**Author:** [@Arpit\_Gulati](https://discuss.elastic.co/u/Arpit_Gulati)\ **Replies:** 4\ **Last updated:** [April 12, 2018, 8:34am UTC](https://discuss.elastic.co/t/create-multiple-groks-for-different-logs/127623 "2018-04-12T08:34:58Z")
Hey , I want to create a grok parser filter rules for 2 different logs . For example for nginx logs , a different grok parser rule and for apache a different grok parser in a same filter block of logstash.conf(/etc/logs… --- ## [Logstash service crash 5.6.1](https://discuss.elastic.co/t/logstash-service-crash-5-6-1/127118)
**Author:** [@slava1](https://discuss.elastic.co/u/slava1)\ **Replies:** 6\ **Last updated:** [April 12, 2018, 7:28am UTC](https://discuss.elastic.co/t/logstash-service-crash-5-6-1/127118 "2018-04-12T07:28:29Z")
Hi, I used Centos 7 with elk stack 5.6.1 Logstash service crash when restarted. I notice that from logstash configuration only input with tcp do not work: input { tcp { port =\> "5759" type =\> "iis" co… --- ## [Can we change sincedb different location for different input?](https://discuss.elastic.co/t/can-we-change-sincedb-different-location-for-different-input/127022)
**Author:** [@Karthik\_Saravanan](https://discuss.elastic.co/u/Karthik_Saravanan)\ **Replies:** 13\ **Last updated:** [April 12, 2018, 6:57am UTC](https://discuss.elastic.co/t/can-we-change-sincedb-different-location-for-different-input/127022 "2018-04-12T06:57:06Z")
I have changed path.data on logstash.yml path.data:D:/www/logstash-6.2.3/pr/ Input file: input { file { path =\> "D:/ELK-Sample-CSV/txt-5/test-import.csv" \<-- this file have 100k lines start\_position =\> "beg… --- ## [Logstash RabbitMQ input -\> ES intermittent issues](https://discuss.elastic.co/t/logstash-rabbitmq-input-es-intermittent-issues/127744)
**Author:** [@Renault\_Hess](https://discuss.elastic.co/u/Renault_Hess)\ **Replies:** 0\ **Last updated:** [April 12, 2018, 6:44am UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-es-intermittent-issues/127744 "2018-04-12T06:44:50Z")
Hey guys :slight\_smile: I need some advice on an ELK setup we have at work. We have 3 ElasticSearch (6.x) nodes (all mdi), and 3 Kibana (6.x) instances on the same boxes as ES. Then we have 2 Logstash instances (each on… --- ## [Storing RabbitMQ Logs in ELK](https://discuss.elastic.co/t/storing-rabbitmq-logs-in-elk/126686)
**Author:** [@mils](https://discuss.elastic.co/u/mils)\ **Replies:** 4\ **Last updated:** [April 12, 2018, 6:36am UTC](https://discuss.elastic.co/t/storing-rabbitmq-logs-in-elk/126686 "2018-04-12T06:36:31Z")
Hi, I have been using ELK for about six months now, and it's been great so far. I'm on logstash version 6.2.3. RabbitMQ makes up the heart of my distributed system (RabbitMQ is itself distributed), and as such it is ve… --- ## [Logstash Coding problem](https://discuss.elastic.co/t/logstash-coding-problem/127717)
**Author:** [@Blackcat308](https://discuss.elastic.co/u/Blackcat308)\ **Replies:** 2\ **Last updated:** [April 12, 2018, 6:25am UTC](https://discuss.elastic.co/t/logstash-coding-problem/127717 "2018-04-12T06:25:14Z")
Synchronized data from mysql to Elasticsearch After the Chinese data is garbled Configured in the logstash configuration file UTF-8 GBK, etc. Not OK Someone knows how to solve it? Remarks Database encoding is UTF-8\[Baid… --- ## [Logstash input beats plugin id parameter not work](https://discuss.elastic.co/t/logstash-input-beats-plugin-id-parameter-not-work/127715)
**Author:** [@Rmond](https://discuss.elastic.co/u/Rmond)\ **Replies:** 2\ **Last updated:** [April 12, 2018, 5:12am UTC](https://discuss.elastic.co/t/logstash-input-beats-plugin-id-parameter-not-work/127715 "2018-04-12T05:12:26Z")
my config input { beats { id =\> "my\_plugin\_id" port =\> 5044 } } but i can't get the id info when i use kibana \[image\] --- ## [X-pack with logstash 6.2.3 can't connect to es server](https://discuss.elastic.co/t/x-pack-with-logstash-6-2-3-cant-connect-to-es-server/127719)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 1\ **Last updated:** [April 12, 2018, 2:59am UTC](https://discuss.elastic.co/t/x-pack-with-logstash-6-2-3-cant-connect-to-es-server/127719 "2018-04-12T02:59:50Z")
i configure it in logstash.yml file with xpack moniting , but the setting not use when logstash is starting output: \[2018-04-12T10:42:52,827\]\[WARN \]\[logstash.outputs.elasticsearch\] You are using a deprecated config se… --- ## [Index datetime from log file instead of auto datetime](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296)
**Author:** [@commonman.net](https://discuss.elastic.co/u/commonman.net)\ **Replies:** 6\ **Last updated:** [April 12, 2018, 2:43am UTC](https://discuss.elastic.co/t/index-datetime-from-log-file-instead-of-auto-datetime/127296 "2018-04-12T02:43:46Z")
Hi Team, I'm trying to load log data into Elasticsearch through Logstash. My log file is back dated. however, date is not indexed from log file. How to use log file date for searching.. Highly appreciated your respons… --- ## [Unable to create multiple index in elastic from logstash](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643)
**Author:** [@sauravsuman689](https://discuss.elastic.co/u/sauravsuman689)\ **Replies:** 8\ **Last updated:** [April 12, 2018, 2:32am UTC](https://discuss.elastic.co/t/unable-to-create-multiple-index-in-elastic-from-logstash/127643 "2018-04-12T02:32:06Z")
Hi, I am using filebeat-\>logstash-\>elastic-\>kibana I am unable to create multiple index in elastic . Please advise. One index is getting created but not both. Filebeat.yml is below filebeat.prospectors: type: log … --- ## [Logstash raising json\_e\_o\_f\_exception when input events are coming from elastisearch](https://discuss.elastic.co/t/logstash-raising-json-e-o-f-exception-when-input-events-are-coming-from-elastisearch/127635)
**Author:** [@Zhihai\_Xian](https://discuss.elastic.co/u/Zhihai_Xian)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 11:25pm UTC](https://discuss.elastic.co/t/logstash-raising-json-e-o-f-exception-when-input-events-are-coming-from-elastisearch/127635 "2018-04-11T23:25:31Z")
Here is my configuration file input { elasticsearch { hosts =\> \["XXXXXXXXXXXXXX.ap-southeast-1.es.amazonaws.com:443"\] index =\> "transcripts" query =\> '{ "query": { "match\_all": {} }' scroll =\> "5m" size =\> 100 ss… --- ## [Syslog forwarding question -\> Logstash (very basic)](https://discuss.elastic.co/t/syslog-forwarding-question-logstash-very-basic/127548)
**Author:** [@heskez](https://discuss.elastic.co/u/heskez)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 9:25pm UTC](https://discuss.elastic.co/t/syslog-forwarding-question-logstash-very-basic/127548 "2018-04-11T21:25:53Z")
Hi there, I'm a newbie. I'd like to forward syslog messages to my ELK stack. So basically am I right to assume logstash is capable of receiving syslog messages and parsing them without sending to a syslog server first? … --- ## [Logstash elasticsearch input retries forever when index does not exist](https://discuss.elastic.co/t/logstash-elasticsearch-input-retries-forever-when-index-does-not-exist/127701)
**Author:** [@santana](https://discuss.elastic.co/u/santana)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 9:05pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-retries-forever-when-index-does-not-exist/127701 "2018-04-11T21:05:23Z")
I use logstash for exporting elastic search indexed data to another system. Indexes in elastic search are created per month. When starting logstash i can see in the logs this exception logged every seconds, i would hope … --- ## [Logstash 6.2.1 Oracle JDBC plugin invalid character in query](https://discuss.elastic.co/t/logstash-6-2-1-oracle-jdbc-plugin-invalid-character-in-query/127668)
**Author:** [@Mauro\_Julian\_Fernand](https://discuss.elastic.co/u/Mauro_Julian_Fernand)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 7:13pm UTC](https://discuss.elastic.co/t/logstash-6-2-1-oracle-jdbc-plugin-invalid-character-in-query/127668 "2018-04-11T19:13:17Z")
I'm trying to fetch data from an Oracle database using this query but I'm constantly getting an Java::JavaSql::SQLSyntaxErrorException: ORA-00911: invalid character error: statement =\> "select \* from SYS.AUD$\_ARCH where… --- ## [Logstash + Rabbitmq delay ramp up rate](https://discuss.elastic.co/t/logstash-rabbitmq-delay-ramp-up-rate/127674)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 4:17pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-delay-ramp-up-rate/127674 "2018-04-11T16:17:02Z")
The issue I have is that logstash slowly ramps up in clearning the queue (using Rabbitmq). During a spike of activity the queue in Rabbitmq can grow to very rappidly but it takes minutes for logstash to start increasing… --- ## [Use case jdbc and logstash updates](https://discuss.elastic.co/t/use-case-jdbc-and-logstash-updates/127686)
**Author:** [@The\_Juke\_Box\_Hero](https://discuss.elastic.co/u/The_Juke_Box_Hero)\ **Replies:** 3\ **Last updated:** [April 11, 2018, 6:36pm UTC](https://discuss.elastic.co/t/use-case-jdbc-and-logstash-updates/127686 "2018-04-11T18:36:35Z")
Hi, I wanted to review this use case with you guys and get some ideas as to whether is possible to pull this off or not. USE CASE: I'm using JDBC to mssql. Step 1: Index all data for the first time using logstash (do… --- ## [Unable to start logstash getting error](https://discuss.elastic.co/t/unable-to-start-logstash-getting-error/126093)
**Author:** [@Shiv\_Gupta](https://discuss.elastic.co/u/Shiv_Gupta)\ **Replies:** 65\ **Last updated:** [April 11, 2018, 5:31pm UTC](https://discuss.elastic.co/t/unable-to-start-logstash-getting-error/126093 "2018-04-11T17:31:58Z")
Hello All, could you please help me to solve the below error getting in logstash while starting. earlier it was working fine , suddenly started getting below- \[ERROR\] 2018-03-29 17:47:09.503 \[main\] Logstash - java.lang… --- ## [Using convert =\> date in csv filter](https://discuss.elastic.co/t/using-convert-date-in-csv-filter/127684)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 5:12pm UTC](https://discuss.elastic.co/t/using-convert-date-in-csv-filter/127684 "2018-04-11T17:12:46Z")
What am I missing here? When I run this configuration input { generator { message =\> '2018/03/16,2018-02-15,2003-11-19 13:01:59' count =\> 1 } } output { stdout { codec =\> rubydebug } } filter { csv { convert =\> { "co… --- ## [Having issues with a specific "message" field while parsing using Filebeat and Logstash](https://discuss.elastic.co/t/having-issues-with-a-specific-message-field-while-parsing-using-filebeat-and-logstash/127086)
**Author:** [@Deepak\_Poola](https://discuss.elastic.co/u/Deepak_Poola)\ **Replies:** 18\ **Last updated:** [April 11, 2018, 4:33pm UTC](https://discuss.elastic.co/t/having-issues-with-a-specific-message-field-while-parsing-using-filebeat-and-logstash/127086 "2018-04-11T16:33:32Z")
I am trying to push logs in json format to logstash through filebeat. My logs are decoded/parsed correctly except for only one field with name "message". When I rename the field, it is being parsed correctly. There is is… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=780) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=782)