# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=791 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 792 --- ## [Logstash jdbc\_static filter and MariaDB](https://discuss.elastic.co/t/logstash-jdbc-static-filter-and-mariadb/121734)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 6\ **Last updated:** [March 28, 2018, 4:26pm UTC](https://discuss.elastic.co/t/logstash-jdbc-static-filter-and-mariadb/121734 "2018-03-28T16:26:05Z")
I can't get this to work; My filter config is; .......... jdbc\_driver\_class =\> "org.mariadb.jdbc.Driver" jdbc\_driver\_library =\> "C:\\Users\\paul\\bitbucket\\enrichment\\drivers\\mariadb-java-client-2.2.2.jar" … --- ## [Could not locate that index-pattern-field (id: geoip.location)](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 5\ **Last updated:** [March 28, 2018, 4:21pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501 "2018-03-28T16:21:05Z")
Hi, Since I updated to Version: 6.1.1 (Logstash, Elasticsearch, Kibana) I recieve the following error. I searched today and read a few things about that. I have the following lines in: 11-pfsense.conf geoip { add\_ta… --- ## [MS SQL perfomance logs to logstash](https://discuss.elastic.co/t/ms-sql-perfomance-logs-to-logstash/125892)
**Author:** [@MrFrost](https://discuss.elastic.co/u/MrFrost)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 9:06am UTC](https://discuss.elastic.co/t/ms-sql-perfomance-logs-to-logstash/125892 "2018-03-28T09:06:16Z")
Hello, I am trying to monitor MS SQL performance by pushing below data to logstash and then to dashboards in Kibana: Average Select in time Average Update in time Average Delete in time Average Select in time Avera… --- ## [And operator in logstash output](https://discuss.elastic.co/t/and-operator-in-logstash-output/125822)
**Author:** [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 2:04pm UTC](https://discuss.elastic.co/t/and-operator-in-logstash-output/125822 "2018-03-28T14:04:34Z")
I am sending JSON logs to logstash. Amongst the fields, there are two I am looking for - \[records\]\[LogicalServerName\] \[records\]\[category\] I wrote an output like such - else if \[records\]\[LogicalServerName\] == "servern… --- ## [Logstash loses tranmission with Filebeat](https://discuss.elastic.co/t/logstash-loses-tranmission-with-filebeat/125943)
**Author:** [@omnitech](https://discuss.elastic.co/u/omnitech)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 1:20pm UTC](https://discuss.elastic.co/t/logstash-loses-tranmission-with-filebeat/125943 "2018-03-28T13:20:26Z")
Hi, I am currently using Logstash and Filebeat for our central log server and for some reason it loses a sync about every two weeks. Both servers are currently running Ubuntu 16.04, and Logstash and Filebeat are versio… --- ## [Import nested documents (csv) into elasticsearch](https://discuss.elastic.co/t/import-nested-documents-csv-into-elasticsearch/125937)
**Author:** [@kevkos236](https://discuss.elastic.co/u/kevkos236)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 12:56pm UTC](https://discuss.elastic.co/t/import-nested-documents-csv-into-elasticsearch/125937 "2018-03-28T12:56:39Z")
Hi, we are currently looking for a proper way to import some data into elasticsearch. The data is basically a relational datamodel split into several csv files. For example we have a csv customer with multiple columns … --- ## [SNMP Input](https://discuss.elastic.co/t/snmp-input/125763)
**Author:** [@DanV](https://discuss.elastic.co/u/DanV)\ **Replies:** 2\ **Last updated:** [March 28, 2018, 12:19pm UTC](https://discuss.elastic.co/t/snmp-input/125763 "2018-03-28T12:19:03Z")
Hello, i want to have as an input for logstash SNMP polling responses. I was thinking of using the input plugin pipe to use the command snmpget output as an input (confuse huh? haha), the usage of the pipe plugin in tha… --- ## [Logstash Bulk indexing. Not all documents inserted, but no errors](https://discuss.elastic.co/t/logstash-bulk-indexing-not-all-documents-inserted-but-no-errors/125924)
**Author:** [@shalinsingh](https://discuss.elastic.co/u/shalinsingh)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 11:46am UTC](https://discuss.elastic.co/t/logstash-bulk-indexing-not-all-documents-inserted-but-no-errors/125924 "2018-03-28T11:46:24Z")
Hi Friends, I am pushing data to Elastic using logstash elasticserach plugins, It failed to push all records to Elastic, my data set has few date columns, when I removed those from query then it pushes arround 95% data, … --- ## [Logstash Multiple Pipeline](https://discuss.elastic.co/t/logstash-multiple-pipeline/124899)
**Author:** [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\ **Replies:** 2\ **Last updated:** [March 28, 2018, 11:43am UTC](https://discuss.elastic.co/t/logstash-multiple-pipeline/124899 "2018-03-28T11:43:04Z")
Hi All, I am curious to know running multiple pipelines in logstash I uncomment the path.config in logstash.yml and keep some pipeline configs in pipelines.yml, how can i add more configs without stopping existing proc… --- ## [Logstash adding unwanted \\ \\ to field name](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 5\ **Last updated:** [March 28, 2018, 11:35am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877 "2018-03-28T11:35:52Z")
Hi, I'm using the http\_poller to poll for some data and this is working fine except for one site. The site provides data in JSON and it displays fine in a browser and doesn't show the \\ in rawdata view but for some reas… --- ## [Protobuf Codec -\> Several classes, How I declared them?](https://discuss.elastic.co/t/protobuf-codec-several-classes-how-i-declared-them/125872)
**Author:** [@rafael.leon](https://discuss.elastic.co/u/rafael.leon)\ **Replies:** 2\ **Last updated:** [March 28, 2018, 8:16am UTC](https://discuss.elastic.co/t/protobuf-codec-several-classes-how-i-declared-them/125872 "2018-03-28T08:16:13Z")
Hello everyone, I'm making a dynatrace's BusinessTransactions integration with logstash + es. I have a pb.rb generated file with ruby-protoc with three classes: #!/usr/bin/env ruby # Generated by the protocol buffer c… --- ## [Another Filter is not work after json filter](https://discuss.elastic.co/t/another-filter-is-not-work-after-json-filter/125706)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 10\ **Last updated:** [March 28, 2018, 7:57am UTC](https://discuss.elastic.co/t/another-filter-is-not-work-after-json-filter/125706 "2018-03-28T07:57:15Z")
I have some log with json type. Im using filter json for my log. My config look like filter { if \[type\] == "wifishop" { json { source =\> "message" target =\> "frt.wifi" remove\_field =\> \["message"… --- ## [Extract a subfield value to display on Kibana](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800)
**Author:** [@arun3](https://discuss.elastic.co/u/arun3)\ **Replies:** 5\ **Last updated:** [March 28, 2018, 7:30am UTC](https://discuss.elastic.co/t/extract-a-subfield-value-to-display-on-kibana/125800 "2018-03-28T07:30:04Z")
Hi, Below is the content of a field say "Field1" when we do Discover with an index on Kibana dashboard. I want to extract value of a particular subfield like Request Size or Request IP or any other and visualize on Kib… --- ## [Want to configure logstash in high-availability](https://discuss.elastic.co/t/want-to-configure-logstash-in-high-availability/125880)
**Author:** [@Nishant\_Hurnekar](https://discuss.elastic.co/u/Nishant_Hurnekar)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 7:27am UTC](https://discuss.elastic.co/t/want-to-configure-logstash-in-high-availability/125880 "2018-03-28T07:27:05Z")
Hi, Our setup as below: FIlebeat configured on multiple servers. Elastic search in 3 node cluster Single node logstash server with persistent queue Single node kibana interface. We would like to make 2 node logstash … --- ## [JDBC connects to different ip as configured](https://discuss.elastic.co/t/jdbc-connects-to-different-ip-as-configured/125867)
**Author:** [@MegaThorx](https://discuss.elastic.co/u/MegaThorx)\ **Replies:** 2\ **Last updated:** [March 28, 2018, 7:13am UTC](https://discuss.elastic.co/t/jdbc-connects-to-different-ip-as-configured/125867 "2018-03-28T07:13:26Z")
The logstash-input-jdbc plugin ignores my server ip which it should connect to. I'm running Logsasth 6.2.2 in docker and added the MariaDB Java Client v2.2.3 to it. I also tried the MySQL Connect Java 5.1.36 but got the… --- ## [\[FATAL\]\[logstash.runner\] ... undefined local variable or method](https://discuss.elastic.co/t/fatal-logstash-runner-undefined-local-variable-or-method/125170)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 7:02am UTC](https://discuss.elastic.co/t/fatal-logstash-runner-undefined-local-variable-or-method/125170 "2018-03-28T07:02:28Z")
Hi, When I put the conf file in : /etc/logstash/conf.d and restart logstash service, I receive the following FATAL log in : logstash-plain.log But lunching logstash in command line with the same conf file doesn't pr… --- ## [Logstash using protobuf as http input codec](https://discuss.elastic.co/t/logstash-using-protobuf-as-http-input-codec/125697)
**Author:** [@rafael.leon](https://discuss.elastic.co/u/rafael.leon)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 6:26am UTC](https://discuss.elastic.co/t/logstash-using-protobuf-as-http-input-codec/125697 "2018-03-28T06:26:43Z")
Hi everyone. I'm facing some issues using a dockerized logstash when I use an http input with protobuf as codec. I'm using logstash (6.2.3) to receive some dynatrace's Business Transactions and then route them to differ… --- ## [Logstash JMX Set up issue](https://discuss.elastic.co/t/logstash-jmx-set-up-issue/125856)
**Author:** [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 5:49am UTC](https://discuss.elastic.co/t/logstash-jmx-set-up-issue/125856 "2018-03-28T05:49:15Z")
Hi, I am using the following setup! ES,Logstash,Kibana - 6.2.2 I am using the MetricBeat Jolokia module for forwarding the JMX details and installed the JMX as a webarchive in the app servers. Its returning the values… --- ## [Element seqNum 0 is expected to be 5](https://discuss.elastic.co/t/element-seqnum-0-is-expected-to-be-5/125857)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 5:54am UTC](https://discuss.elastic.co/t/element-seqnum-0-is-expected-to-be-5/125857 "2018-03-28T05:54:51Z")
does anyone know this logstash error ? PageIO recovery element index:4, readNextElement exception: Element seqNum 0 is expected to be 5 --- ## [Ruby Filter - Preserving Case](https://discuss.elastic.co/t/ruby-filter-preserving-case/125847)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 4:22am UTC](https://discuss.elastic.co/t/ruby-filter-preserving-case/125847 "2018-03-28T04:22:34Z")
Update: I'm being careless, I had the field listed in a mutate\>lowercase function later on in the pipe :roll\_eyes: Ingesting Twitter data with the twitter input and then running ruby inline code to put links in a separ… --- ## [Log haven't push to](https://discuss.elastic.co/t/log-havent-push-to/125853)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 4:41am UTC](https://discuss.elastic.co/t/log-havent-push-to/125853 "2018-03-28T04:41:16Z")
hi there i use tcp input \> grok filter \> amazon\_es output \> then see the logs at kibana it works for me but yesterday i change logstash config for some patterns then logstash can not push the logs to amazon\_es domain. … --- ## [Can't figure out how to translate from Json to Avro using logstash](https://discuss.elastic.co/t/cant-figure-out-how-to-translate-from-json-to-avro-using-logstash/125464)
**Author:** [@jbotello](https://discuss.elastic.co/u/jbotello)\ **Replies:** 4\ **Last updated:** [March 27, 2018, 5:28am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-translate-from-json-to-avro-using-logstash/125464 "2018-03-27T05:28:13Z")
Hi, I'm been trying to figure out how to transform a json encoded using kafka input and using avro as an output. So far, no luck :frowning: This is an example of my current configuration without using any filtering or… --- ## [Multipile s3 plugin inputs with different prefix](https://discuss.elastic.co/t/multipile-s3-plugin-inputs-with-different-prefix/125843)
**Author:** [@eugene-marchenko](https://discuss.elastic.co/u/eugene-marchenko)\ **Replies:** 0\ **Last updated:** [March 28, 2018, 3:27am UTC](https://discuss.elastic.co/t/multipile-s3-plugin-inputs-with-different-prefix/125843 "2018-03-28T03:27:57Z")
Hey! I just wondering if it's a bug or feature. my different ELBs are put logs to the same bucket but creates different prefix like: s3://prod-elb-logs/\[elb\_name\]/... I use multiple s3 inputs with the same bucket b… --- ## [Best solutions for cross organization one point of truth](https://discuss.elastic.co/t/best-solutions-for-cross-organization-one-point-of-truth/125478)
**Author:** [@elitzur\_e](https://discuss.elastic.co/u/elitzur_e)\ **Replies:** 2\ **Last updated:** [March 28, 2018, 1:37am UTC](https://discuss.elastic.co/t/best-solutions-for-cross-organization-one-point-of-truth/125478 "2018-03-28T01:37:36Z")
Hi. i have been researching for the best solution for this scenario: my organization has 2 unrelated logs sections: Application section: -made of serval applications (each application can, in theory, be grouped by a… --- ## [Multiple output to same elasticsearch in order, one for delete action, another for normal action(create if)](https://discuss.elastic.co/t/multiple-output-to-same-elasticsearch-in-order-one-for-delete-action-another-for-normal-action-create-if/125691)
**Author:** [@Jin\_Qian](https://discuss.elastic.co/u/Jin_Qian)\ **Replies:** 4\ **Last updated:** [March 28, 2018, 1:30am UTC](https://discuss.elastic.co/t/multiple-output-to-same-elasticsearch-in-order-one-for-delete-action-another-for-normal-action-create-if/125691 "2018-03-28T01:30:14Z")
See detail in https://stackoverflow.com/questions/49441683/logstash-elasticsearch-how-can-i-remove-all-data-before-output-new-data I just want to delete old data before output new data. So I am curious, if I define two… --- ## [Filter\_jdbc\_static & Apache Derby](https://discuss.elastic.co/t/filter-jdbc-static-apache-derby/122014)
**Author:** [@c0untzer0](https://discuss.elastic.co/u/c0untzer0)\ **Replies:** 3\ **Last updated:** [March 27, 2018, 9:56pm UTC](https://discuss.elastic.co/t/filter-jdbc-static-apache-derby/122014 "2018-03-27T21:56:29Z")
Hi, I'm having an issue regarding this filter. When I launch the jdbc\_static and throw some data its way, the logs of internal Apache Derby instance says this: java.lang.StackOverflowError at org.apache.derby.impl.sql… --- ## [Can't connect to elasticsearch from logstash](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-logstash/125812)
**Author:** [@Sergey\_Murashov](https://discuss.elastic.co/u/Sergey_Murashov)\ **Replies:** 0\ **Last updated:** [March 27, 2018, 8:28pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-logstash/125812 "2018-03-27T20:28:11Z")
I installed the searchguard and can not connect the logstash. In the logs I see that: \[Manticore::ClientProtocolException\] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable t… --- ## [Where to put pipeline configuration files on Windows 10?](https://discuss.elastic.co/t/where-to-put-pipeline-configuration-files-on-windows-10/125450)
**Author:** [@Ongun](https://discuss.elastic.co/u/Ongun)\ **Replies:** 4\ **Last updated:** [March 27, 2018, 8:09pm UTC](https://discuss.elastic.co/t/where-to-put-pipeline-configuration-files-on-windows-10/125450 "2018-03-27T20:09:43Z")
Where should I put pipeline configuration files (input-\>filter-\>output) referred to in pipelines.yml file on Windows 10? I am using Logstash 6.2.2 and I noticed that if the file names do not contain accented characters … --- ## [Dynamically assigning timezone from a filebeat event](https://discuss.elastic.co/t/dynamically-assigning-timezone-from-a-filebeat-event/125669)
**Author:** [@rajisankar](https://discuss.elastic.co/u/rajisankar)\ **Replies:** 4\ **Last updated:** [March 27, 2018, 7:03pm UTC](https://discuss.elastic.co/t/dynamically-assigning-timezone-from-a-filebeat-event/125669 "2018-03-27T19:03:52Z")
I am shipping logs to logstash from filebeat. I have added the processor to add beat.timezone. But, when beat.timezone returns "EDT" (which currently is correct), logstash fails to parse as its unable to identify EDT. in… --- ## [UTC date in output filename](https://discuss.elastic.co/t/utc-date-in-output-filename/125790)
**Author:** [@Milan\_Kaliraj](https://discuss.elastic.co/u/Milan_Kaliraj)\ **Replies:** 4\ **Last updated:** [March 27, 2018, 6:22pm UTC](https://discuss.elastic.co/t/utc-date-in-output-filename/125790 "2018-03-27T18:22:46Z")
I am trying to save input date to a file in logstash. The output file has "%{+YYYYMMdd}" appended but this time is UTC time. How can i append file name on local time? [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=790) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=792)