# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=782 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 783 --- ## [error=\>"Elasticsearch Unreachable:](https://discuss.elastic.co/t/error-elasticsearch-unreachable/127676)
**Author:** [@dchan08](https://discuss.elastic.co/u/dchan08)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 4:24pm UTC](https://discuss.elastic.co/t/error-elasticsearch-unreachable/127676 "2018-04-11T16:24:13Z")
Hi, i was running the latest version of ELK stack and decided to add x-pack to it, after which when i tried to run the configuration file in logstash it throws me the following error \[INFO \] 2018-04-11 06:09:25.860 \[ma… --- ## [Logstash 6.2.3 filter/mutate/spit quandry](https://discuss.elastic.co/t/logstash-6-2-3-filter-mutate-spit-quandry/125988)
**Author:** [@davehatma](https://discuss.elastic.co/u/davehatma)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 3:25pm UTC](https://discuss.elastic.co/t/logstash-6-2-3-filter-mutate-spit-quandry/125988 "2018-04-11T15:25:05Z")
So, I'm scratching my head here. After exhaustive Googling I just don't know why this apparently simple function isn't working for me. Here is the filter/mutate code. mutate { add\_field =\> {"temp" =\> "poc… --- ## [Logstash 6.2 Multiple Pipelines,each with its own output file](https://discuss.elastic.co/t/logstash-6-2-multiple-pipelines-each-with-its-own-output-file/127547)
**Author:** [@davehatma](https://discuss.elastic.co/u/davehatma)\ **Replies:** 6\ **Last updated:** [April 11, 2018, 3:23pm UTC](https://discuss.elastic.co/t/logstash-6-2-multiple-pipelines-each-with-its-own-output-file/127547 "2018-04-11T15:23:08Z")
I'm running three pipelines from 'pipelines.yml' each pipeline config file has its own output filter: file { path =\> "/var/log/logstash/logstash-\[my-pipeline name\].log" } I'm finding that the output for all thr… --- ## [Installation of prune plugin fails on Logstash 6.2.2](https://discuss.elastic.co/t/installation-of-prune-plugin-fails-on-logstash-6-2-2/127662)
**Author:** [@gaccardo](https://discuss.elastic.co/u/gaccardo)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 3:14pm UTC](https://discuss.elastic.co/t/installation-of-prune-plugin-fails-on-logstash-6-2-2/127662 "2018-04-11T15:14:48Z")
When I try to install the prune plugin for logstash, I get the following error. Any help to fix this would be appreciated. xxx@yyyyyyyy:/usr/local/elastic/logstash-6.2.2$ bin/logstash-plugin install logstash-filter-pru… --- ## [Logstack dissect missing delimiter](https://discuss.elastic.co/t/logstack-dissect-missing-delimiter/127647)
**Author:** [@snewman](https://discuss.elastic.co/u/snewman)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 2:35pm UTC](https://discuss.elastic.co/t/logstack-dissect-missing-delimiter/127647 "2018-04-11T14:35:48Z")
When using the dissect plugin for logstash, it correctly parses most of the message, except for the first field which uses the cat function. The test line that is being parsed is 2018-02-15|03:00:11.450|TEST|TEST|TEST|T… --- ## [If conditional " in " doesn't work, but " == " does? I need the "in" conditional to work!](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441)
**Author:** [@JimP](https://discuss.elastic.co/u/JimP)\ **Replies:** 9\ **Last updated:** [April 11, 2018, 1:57pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441 "2018-04-11T13:57:22Z")
In my logstash .conf, filter section when I use "==" it works, but when I replace with "in" it doesn't. Further down in the script, I do use "in" with multiple values, and none of them work either. Am I missing something… --- ## [Reading excel file in logstash](https://discuss.elastic.co/t/reading-excel-file-in-logstash/127634)
**Author:** [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 1:20pm UTC](https://discuss.elastic.co/t/reading-excel-file-in-logstash/127634 "2018-04-11T13:20:10Z")
Can anyone help in reading excel file in logstash and output to mongo db --- ## [Multiple network interfaces settings and X-PACK](https://discuss.elastic.co/t/multiple-network-interfaces-settings-and-x-pack/126585)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 1:09pm UTC](https://discuss.elastic.co/t/multiple-network-interfaces-settings-and-x-pack/126585 "2018-04-11T13:09:01Z")
Hello, I have a server with 2 network interfaces, one on a private network and the other on internet. On my private network, I have an elasticsearch cluster with X-PACK (ip-filtering). This cluster is not open on inter… --- ## [Multi-Line Codec Help](https://discuss.elastic.co/t/multi-line-codec-help/126071)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 3\ **Last updated:** [April 11, 2018, 12:55pm UTC](https://discuss.elastic.co/t/multi-line-codec-help/126071 "2018-04-11T12:55:25Z")
We need some help with the multiline codec. We have syslog entries arriving - the message lines look like this: jvm 1 : ERROR \[fooHTTP38\] \[10.1.102.49\] \[AbstractResource\] Error crea jvm 1 : de.foo.platform.webservi… --- ## [Probleme with multiline](https://discuss.elastic.co/t/probleme-with-multiline/127627)
**Author:** [@candyou](https://discuss.elastic.co/u/candyou)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 12:44pm UTC](https://discuss.elastic.co/t/probleme-with-multiline/127627 "2018-04-11T12:44:09Z")
Hello, i just started working with Logstash, and i have a problem with multiline i'm not able to cosiderate two line of log in one line, i passed two days to search in internt but i still blocked, here is a part of my… --- ## [\[SOLVE\] Logstash output works but fail to feed elasticsearch](https://discuss.elastic.co/t/solve-logstash-output-works-but-fail-to-feed-elasticsearch/127602)
**Author:** [@lu1her](https://discuss.elastic.co/u/lu1her)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 12:41pm UTC](https://discuss.elastic.co/t/solve-logstash-output-works-but-fail-to-feed-elasticsearch/127602 "2018-04-11T12:41:17Z")
I am trying to pass my API custom log files to Kibana. For that I use myLogFiles.log -\> Logstash -\> Elasticsearch -\> Kibana. PROBLEM Logstash output tells that everything is fine, but Elasticsearch remain empty (I chec… --- ## [Adding to a CSV file data-set some metadata from a Json file](https://discuss.elastic.co/t/adding-to-a-csv-file-data-set-some-metadata-from-a-json-file/126115)
**Author:** [@camminati](https://discuss.elastic.co/u/camminati)\ **Replies:** 5\ **Last updated:** [April 11, 2018, 12:36pm UTC](https://discuss.elastic.co/t/adding-to-a-csv-file-data-set-some-metadata-from-a-json-file/126115 "2018-04-11T12:36:24Z")
Hello, I am trying to do the following: what I have I have a csv file that contains some a data-set LG\_data.csv OWNER;CATEGORY;TASK;ID;TEN\_ID;CHANNEL\_ID;CODE;PLANNED\_START;TIME\_STORED;TIME\_QUEUED;TIME\_STARTED;TIME\_D… --- ## [Logstash date filter in string format for input 150M](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415)
**Author:** [@pcouas](https://discuss.elastic.co/u/pcouas)\ **Replies:** 4\ **Last updated:** [April 11, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-date-filter-in-string-format-for-input-150m/127415 "2018-04-11T11:29:59Z")
Hi My logstash filter logdate is converted to "string" field and not to "date" field, if all my log rotated field are more 150 Mo ? An idea ? Regards Phil logstash 5.6.8 --- ## [Unknown setting 'capitalize' for mutate Error](https://discuss.elastic.co/t/unknown-setting-capitalize-for-mutate-error/127616)
**Author:** [@FreeYourMinds](https://discuss.elastic.co/u/FreeYourMinds)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 11:22am UTC](https://discuss.elastic.co/t/unknown-setting-capitalize-for-mutate-error/127616 "2018-04-11T11:22:49Z")
Hi, running Logstash 6.2.2 and trying to use the capitalize mutation if \[LogLevel\] { mutate { capitalize =\> \[ "LogLevel" \] } } Logstash fails to load its configuration reporting in the Log \[ERROR\]\[logstash.f… --- ## [Parse multiline CSV files of different headers using logstash http input](https://discuss.elastic.co/t/parse-multiline-csv-files-of-different-headers-using-logstash-http-input/127439)
**Author:** [@ysree](https://discuss.elastic.co/u/ysree)\ **Replies:** 0\ **Last updated:** [April 10, 2018, 7:57am UTC](https://discuss.elastic.co/t/parse-multiline-csv-files-of-different-headers-using-logstash-http-input/127439 "2018-04-10T07:57:52Z")
Hi, Is there a way to parse multiple CSV files of different headers using logstash. EG: Post a csv file using curl command curl -XPOST 'http://10.197.37.94:31311' --data-binary @mycsv.csv -H 'Content-type:text/csv; … --- ## [Logstash parsing help - custom log](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920)
**Author:** [@Yuvaraja\_kannan](https://discuss.elastic.co/u/Yuvaraja_kannan)\ **Replies:** 4\ **Last updated:** [April 11, 2018, 9:25am UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920 "2018-04-11T09:25:18Z")
HI All, The below is the sample line from my log file, May i know how do i filter out only the processName and totalExecutionTime using logstash grok. Please help. 17:44:09.0083 Info {"message":"demo execution ended",… --- ## [Grok with multiple square brackerts](https://discuss.elastic.co/t/grok-with-multiple-square-brackerts/127589)
**Author:** [@zxc654951](https://discuss.elastic.co/u/zxc654951)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 8:52am UTC](https://discuss.elastic.co/t/grok-with-multiple-square-brackerts/127589 "2018-04-11T08:52:27Z")
hello, I had a log with multiple square brackets like below： \[info 2018/04/11 23:59:59.999999 ABC ABCDEX:99999 123456789876543\] IO error\[000\] installed ... ... ...\[ABCDEX:90909\]: ...::... failed with errno: 000: ... ..… --- ## [Logstash 5.6.8 two outputs error](https://discuss.elastic.co/t/logstash-5-6-8-two-outputs-error/127561)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 14\ **Last updated:** [April 11, 2018, 8:45am UTC](https://discuss.elastic.co/t/logstash-5-6-8-two-outputs-error/127561 "2018-04-11T08:45:23Z")
output have two. one is output to es one is output to tcp (logstash is tcp client). when the tcp server is down ,but the es is online .can't bulk data into es why? and how slove it? --- ## [Winlogbeat keywords filtering issue in Logstash](https://discuss.elastic.co/t/winlogbeat-keywords-filtering-issue-in-logstash/127278)
**Author:** [@sru](https://discuss.elastic.co/u/sru)\ **Replies:** 8\ **Last updated:** [April 11, 2018, 8:26am UTC](https://discuss.elastic.co/t/winlogbeat-keywords-filtering-issue-in-logstash/127278 "2018-04-11T08:26:37Z")
Hello, I'm strugling with filtering (drop) of events with certain keywords delivered from winlogbeat (6.2.1 / 6.2.3) to logstash (6.2.1). Events with this pattern should be droped in Logstash and I know, it would be be… --- ## [Drop event](https://discuss.elastic.co/t/drop-event/127328)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 8:25am UTC](https://discuss.elastic.co/t/drop-event/127328 "2018-04-11T08:25:24Z")
I would like to drop particular events from a log message that coming from a socket input. How can I do this? --- ## [I want to know what the flush\_size and idle\_flush\_time has been changed to](https://discuss.elastic.co/t/i-want-to-know-what-the-flush-size-and-idle-flush-time-has-been-changed-to/127478)
**Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Replies:** 4\ **Last updated:** [April 11, 2018, 7:37am UTC](https://discuss.elastic.co/t/i-want-to-know-what-the-flush-size-and-idle-flush-time-has-been-changed-to/127478 "2018-04-11T07:37:35Z")
elasticsearch { hosts =\> localhost index =\> "logstash(%{+YYYY.MM.dd})" document\_type =\>"logstash" flush\_size=\>1000 idle\_flush\_time=\>15 } it didn‘t … --- ## [Logstash input from another file](https://discuss.elastic.co/t/logstash-input-from-another-file/127576)
**Author:** [@temp\_expt](https://discuss.elastic.co/u/temp_expt)\ **Replies:** 3\ **Last updated:** [April 11, 2018, 7:27am UTC](https://discuss.elastic.co/t/logstash-input-from-another-file/127576 "2018-04-11T07:27:48Z")
Hello, This is the SAMPLE config file that I'm using. input { file { path =\> "/my/path/\*/logfile.log" start\_position =\> beginning ignore\_older =\> 0 sincedb\_path =\> "/my/sincedb/path/demo.db" codec =\> pl… --- ## [Logstash Timstamp:\_dateparsefailure issue](https://discuss.elastic.co/t/logstash-timstamp-dateparsefailure-issue/127314)
**Author:** [@vincent25](https://discuss.elastic.co/u/vincent25)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 6:34am UTC](https://discuss.elastic.co/t/logstash-timstamp-dateparsefailure-issue/127314 "2018-04-11T06:34:43Z")
Hi, I need to replace my log timestamp with logstash @timestamp.I have tried all possible ways and time formats but still not able to replace it and getting dateparsefailure issue every time. Can anybody help me to sor… --- ## [Manipulation apache logs](https://discuss.elastic.co/t/manipulation-apache-logs/127520)
**Author:** [@MSt](https://discuss.elastic.co/u/MSt)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 6:08am UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520 "2018-04-11T06:08:55Z")
Hello, can I put the highlighted keyword (www.test.com) into another field and remove it from the beginning of the message? The apache-access log looks like \*\*www.test.com\*\* xx.xx.xx.xx - \[10/Apr/2018:10:44:42 +0200\] … --- ## [Logstash output es workers is which type? logstash 5.6.8](https://discuss.elastic.co/t/logstash-output-es-workers-is-which-type-logstash-5-6-8/127564)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 3:51am UTC](https://discuss.elastic.co/t/logstash-output-es-workers-is-which-type-logstash-5-6-8/127564 "2018-04-11T03:51:54Z")
in the doces,i find not ok. can't settings in output plugins. in https://www.elastic.co/guide/en/logstash/5.6/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-common-options the workers is number \[ima… --- ## [Logstash 5.6.8 output to es can't add workers error](https://discuss.elastic.co/t/logstash-5-6-8-output-to-es-cant-add-workers-error/127562)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 3:37am UTC](https://discuss.elastic.co/t/logstash-5-6-8-output-to-es-cant-add-workers-error/127562 "2018-04-11T03:37:59Z")
when output to es i see the docs at https://www.elastic.co/guide/en/logstash/5.6/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-workers i see it can add the workers but when add the es is output erro… --- ## [How to put condition based on certain string in \[message\]?](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 6\ **Last updated:** [April 10, 2018, 11:08pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169 "2018-04-10T23:08:04Z")
Hi, I am trying to apply grok only if message has certain string. For example my message has source\_type=\\"APP/PROC/WEB\\" and my config looks like, if "source\_type=\\"APP" in \[message\]{ do something } Condition is not … --- ## [Listen loop error: IOError: closed stream](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/127083)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 4\ **Last updated:** [April 10, 2018, 10:52pm UTC](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/127083 "2018-04-10T22:52:55Z")
Hi, When I start the logstash as a service, I receive the folowing error. I have set the pipeline.yml with a single entry as a conf file. at the same time when I start the logstash in commande line, it run correctly an… --- ## [Logstash stalling during auto-reconfigure even though inflight\_events = 0](https://discuss.elastic.co/t/logstash-stalling-during-auto-reconfigure-even-though-inflight-events-0/125423)
**Author:** [@Crisps](https://discuss.elastic.co/u/Crisps)\ **Replies:** 6\ **Last updated:** [April 10, 2018, 10:06pm UTC](https://discuss.elastic.co/t/logstash-stalling-during-auto-reconfigure-even-though-inflight-events-0/125423 "2018-04-10T22:06:21Z")
Hello, I have logstash so that it will autoreconfigure. When it reconfigures, it works fine sometimes, however, sometimes it will randomly give the message \[ERROR\]\[logstash.shutdownwatcher \] The shutdown process appear… --- ## [Logstash port 5044 problem not listening!](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396)
**Author:** [@analistajeff](https://discuss.elastic.co/u/analistajeff)\ **Replies:** 4\ **Last updated:** [April 10, 2018, 9:52pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396 "2018-04-10T21:52:16Z")
logstash port 5044 not binding, i tried to change port to 9066 in my client everything looks ok !! 2018-04-09T19:07:06.934-0300 DEBUG \[prospector\] log/prospector.go:168 Prospector states cleaned up. Before: 1, … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=781) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=783)