# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=793 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 794 --- ## [Extract word from field](https://discuss.elastic.co/t/extract-word-from-field/125598)
**Author:** [@Majuan](https://discuss.elastic.co/u/Majuan)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 6:12pm UTC](https://discuss.elastic.co/t/extract-word-from-field/125598 "2018-03-26T18:12:22Z")
I have Apache logs to index, but i would like to extract more information after groking the logs. One log line is like this : \\ 10.23.252.66 - - \[26/Mar/2018:01:54:40 +0200\] "GET /AppName/services/rest/supervision/super… --- ## [KV Filter Pattern Usage](https://discuss.elastic.co/t/kv-filter-pattern-usage/125657)
**Author:** [@cappy](https://discuss.elastic.co/u/cappy)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 6:11pm UTC](https://discuss.elastic.co/t/kv-filter-pattern-usage/125657 "2018-03-26T18:11:38Z")
Using the latest KV filter plugin (4.1.0)... I'm trying to use the KV filter to parse a log formatted like the following: Protocol: TCP, SrcIP: 192.168.1.1 and so on... (the main idea here is that the key/values are s… --- ## [Out of memory exception under high load](https://discuss.elastic.co/t/out-of-memory-exception-under-high-load/125267)
**Author:** [@Edward99](https://discuss.elastic.co/u/Edward99)\ **Replies:** 3\ **Last updated:** [March 26, 2018, 6:09pm UTC](https://discuss.elastic.co/t/out-of-memory-exception-under-high-load/125267 "2018-03-26T18:09:20Z")
Hi, Our logstash servers are only configured to use in-memory queue since we are still prototyping. We have experienced a few times that the logstash process exited because of an out-of-memory exception. This seems onl… --- ## [Index not appearing in management of kibana](https://discuss.elastic.co/t/index-not-appearing-in-management-of-kibana/125355)
**Author:** [@Shashi\_Bhushan](https://discuss.elastic.co/u/Shashi_Bhushan)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 6:07pm UTC](https://discuss.elastic.co/t/index-not-appearing-in-management-of-kibana/125355 "2018-03-26T18:07:40Z")
\[Screenshot%20from%202018-03-23%2016-38-17\] here is my screenshot of logstash log \[Screenshot%20from%202018-03-23%2016-43-11\] --- ## [While using pipeline Error: Address already in use Exception](https://discuss.elastic.co/t/while-using-pipeline-error-address-already-in-use-exception/125039)
**Author:** [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\ **Replies:** 7\ **Last updated:** [March 26, 2018, 5:54pm UTC](https://discuss.elastic.co/t/while-using-pipeline-error-address-already-in-use-exception/125039 "2018-03-26T17:54:30Z")
Hello Experts, when I was trying to run logstash using pipeline.yml I am running into below error. I don't find any logstash instance running \[root@localhost config\]# ps -ef | grep logstash root 26227 22729 0 09… --- ## [Multiple filters for syslog](https://discuss.elastic.co/t/multiple-filters-for-syslog/125407)
**Author:** [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 5:39pm UTC](https://discuss.elastic.co/t/multiple-filters-for-syslog/125407 "2018-03-26T17:39:00Z")
Can anyone suggest how i might include another match for syslog in this beats.conf? I'm looking to collect some fortigate syslogs in addition to what we are collecting from other syslog sources. input{ beats{ port =\> … --- ## [Apache grok filter not working the way I expect it to. Should I be using a different approach?](https://discuss.elastic.co/t/apache-grok-filter-not-working-the-way-i-expect-it-to-should-i-be-using-a-different-approach/124625)
**Author:** [@William-Robert](https://discuss.elastic.co/u/William-Robert)\ **Replies:** 4\ **Last updated:** [March 26, 2018, 4:31pm UTC](https://discuss.elastic.co/t/apache-grok-filter-not-working-the-way-i-expect-it-to-should-i-be-using-a-different-approach/124625 "2018-03-26T16:31:08Z")
I'm trying to set up filebeat/ELK such that I can drop an apache log file into a directory and it will be indexed automatically. I'm currently succeeding in having the files indexed, however, each log file is just being… --- ## [Logs are ignoring input section in config files](https://discuss.elastic.co/t/logs-are-ignoring-input-section-in-config-files/125480)
**Author:** [@arliber](https://discuss.elastic.co/u/arliber)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 4:13pm UTC](https://discuss.elastic.co/t/logs-are-ignoring-input-section-in-config-files/125480 "2018-03-26T16:13:50Z")
Hi, I have a simple setup for capturing logs though HTTP and TCP. I've created 2 conf files at /etc/logstash/conf.d/ (see below) but logs sent though HTTP are also being passed through the TCP pipeline and vise versa. F… --- ## [Logstash config is not working](https://discuss.elastic.co/t/logstash-config-is-not-working/125621)
**Author:** [@vaishali1](https://discuss.elastic.co/u/vaishali1)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 1:54pm UTC](https://discuss.elastic.co/t/logstash-config-is-not-working/125621 "2018-03-26T13:54:10Z")
Hi, I am facing some issue, Logstash config is not pushing the data to elasticsearch, can anyone help me to solve this issue?, very first time it runs well when I am trying second time it's not working input { jdbc … --- ## [Logstash queue failed to obtain exclusive access](https://discuss.elastic.co/t/logstash-queue-failed-to-obtain-exclusive-access/125596)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 12:24pm UTC](https://discuss.elastic.co/t/logstash-queue-failed-to-obtain-exclusive-access/125596 "2018-03-26T12:24:22Z")
Hello, Suddenly this problem showed up in my logs \[2018-03-26T14:20:52,257\]\[INFO \]\[logstash.inputs.beats \] Beats inputs: Starting input listener {:address=\>"192.168.15.18:5044"} \[2018-03-26T14:20:52,319\]\[INFO \]\[logs… --- ## [How to escape field values for elasticsearch filter query?](https://discuss.elastic.co/t/how-to-escape-field-values-for-elasticsearch-filter-query/125386)
**Author:** [@jdmcalee](https://discuss.elastic.co/u/jdmcalee)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 1:22pm UTC](https://discuss.elastic.co/t/how-to-escape-field-values-for-elasticsearch-filter-query/125386 "2018-03-26T13:22:09Z")
I'm using the elasticsearch filter to enrich an event coming from a database. I'm using a fairly simple query: query =\> "usernames.keyword:%{\[userid\]}@%{\[domain\]}" It works fine, usually. However, I have instances wher… --- ## [How to install logstash ruby filer plugin](https://discuss.elastic.co/t/how-to-install-logstash-ruby-filer-plugin/125600)
**Author:** [@csudaya](https://discuss.elastic.co/u/csudaya)\ **Replies:** 3\ **Last updated:** [March 26, 2018, 1:20pm UTC](https://discuss.elastic.co/t/how-to-install-logstash-ruby-filer-plugin/125600 "2018-03-26T13:20:39Z")
I am trying to execute a workflow in pnda using logstash. The config file has ruby inline code and I understand we need to have plugin. can you please tell me on how to install thesame --- ## [Http input plugin ssl](https://discuss.elastic.co/t/http-input-plugin-ssl/119650)
**Author:** [@GerardBIGOT](https://discuss.elastic.co/u/GerardBIGOT)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 12:50pm UTC](https://discuss.elastic.co/t/http-input-plugin-ssl/119650 "2018-03-26T12:50:45Z")
Hi, The http input plugin works great without SSL. I'm trying to enable the SSL in the http input plugin of logstash. The Beats input plugin works flowlessly with SSL. But, trying to implement the same in http, I can… --- ## [Stock event but no display](https://discuss.elastic.co/t/stock-event-but-no-display/125599)
**Author:** [@Bakkali\_Amine](https://discuss.elastic.co/u/Bakkali_Amine)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 12:39pm UTC](https://discuss.elastic.co/t/stock-event-but-no-display/125599 "2018-03-26T12:39:19Z")
How can I stock event on elasticsearch without displaying them on kibana ? Thank you --- ## [Date format parsing](https://discuss.elastic.co/t/date-format-parsing/125584)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 4\ **Last updated:** [March 26, 2018, 12:19pm UTC](https://discuss.elastic.co/t/date-format-parsing/125584 "2018-03-26T12:19:30Z")
Hi, The Original format of the date in the events is: Monday, March 5, 2018 11:58:24:874 The date filter I used: date { match =\> \[ "timestamp", "EEEE, MMMM d, yyyy HH:mm:ss:SSS" \] } I… --- ## [Configure logstash to read local files recursively and send to elastic cloud](https://discuss.elastic.co/t/configure-logstash-to-read-local-files-recursively-and-send-to-elastic-cloud/125440)
**Author:** [@elastic\_bees](https://discuss.elastic.co/u/elastic_bees)\ **Replies:** 8\ **Last updated:** [March 26, 2018, 9:15am UTC](https://discuss.elastic.co/t/configure-logstash-to-read-local-files-recursively-and-send-to-elastic-cloud/125440 "2018-03-26T09:15:52Z")
Hi, I'm trying to configure logstash to read local files recursively and send the output to elastic cloud. I put my CloudID in /etc/logstash/logstash.yml Should I specify something in the logstatsh conf file? Do you … --- ## [Logstash will continue unprocessed line from CSV file](https://discuss.elastic.co/t/logstash-will-continue-unprocessed-line-from-csv-file/125594)
**Author:** [@Karthik\_Saravanan](https://discuss.elastic.co/u/Karthik_Saravanan)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 12:02pm UTC](https://discuss.elastic.co/t/logstash-will-continue-unprocessed-line-from-csv-file/125594 "2018-03-26T12:02:00Z")
I have doubt on logstash, while importing CSV files, Step 1: importing 10 CSV files(pr\_\*) Ex: input { file { path =\> "D:/ELK-Sample-CSV/pr/pr\_\*.csv" start\_position =\> "beginning" sincedb\_… --- ## [Grok Parsing for Bitbucket Logs](https://discuss.elastic.co/t/grok-parsing-for-bitbucket-logs/125592)
**Author:** [@deepesh\_goel](https://discuss.elastic.co/u/deepesh_goel)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 11:37am UTC](https://discuss.elastic.co/t/grok-parsing-for-bitbucket-logs/125592 "2018-03-26T11:37:27Z")
Hi Guys, Please help me in pasing my bitbukcet logs through grok filter. I am new to this and tried many ways to parse my logs but still not able to do it. Bitbucket Logs: 10.5.204.129 | ssh | o@1JEXCE4x796x69991x0 | … --- ## [Handling exception: Connection reset by peer](https://discuss.elastic.co/t/handling-exception-connection-reset-by-peer/125194)
**Author:** [@Faktu4noCaM](https://discuss.elastic.co/u/Faktu4noCaM)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 11:35am UTC](https://discuss.elastic.co/t/handling-exception-connection-reset-by-peer/125194 "2018-03-26T11:35:38Z")
Hi! After update ELK stack from 6.2.2 to 6.2.3, i recieved warning message in Logstash logs: Log text\[2018-03-22T14:28:20,354\]\[INFO \]\[org.logstash.beats.BeatsHandler\] \[local: 0.0.0.0:5045, remote: 100.100.36.9:49199\] … --- ## [Logstash - 1 event ends up 22 times in elasticsearch](https://discuss.elastic.co/t/logstash-1-event-ends-up-22-times-in-elasticsearch/125583)
**Author:** [@lueneburger](https://discuss.elastic.co/u/lueneburger)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 10:36am UTC](https://discuss.elastic.co/t/logstash-1-event-ends-up-22-times-in-elasticsearch/125583 "2018-03-26T10:36:56Z")
Hi everyone, got a real strange issue right now, haproxy is sending 1 event but logstash send it 22 times to elasticsearch. i did only 1 change in the config (tested before in a test environment, without any problems) … --- ## [Logstash syslog issue](https://discuss.elastic.co/t/logstash-syslog-issue/125383)
**Author:** [@cybersecc](https://discuss.elastic.co/u/cybersecc)\ **Replies:** 8\ **Last updated:** [March 26, 2018, 10:11am UTC](https://discuss.elastic.co/t/logstash-syslog-issue/125383 "2018-03-26T10:11:23Z")
Hello, I have configured a remote server to send syslog to logstash.. When I run tcpdump -Xni eth0 I can see that syslog packets are coming to logstash server, but in elasticsearch I see no results. By the way I read a… --- ## [Code failure](https://discuss.elastic.co/t/code-failure/124939)
**Author:** [@PAU\_SUREDA\_COLL](https://discuss.elastic.co/u/PAU_SUREDA_COLL)\ **Replies:** 4\ **Last updated:** [March 26, 2018, 8:40am UTC](https://discuss.elastic.co/t/code-failure/124939 "2018-03-26T08:40:24Z")
I try to parse my code for fortigate logs. I need to combine two fields in a new one, but i want Kibana show me only the values with some content inside. Can you explain me how to do it? My code: filter{ grok{ match… --- ## [How can i start many logstash conf files as service?](https://discuss.elastic.co/t/how-can-i-start-many-logstash-conf-files-as-service/121834)
**Author:** [@linsie](https://discuss.elastic.co/u/linsie)\ **Replies:** 11\ **Last updated:** [March 26, 2018, 7:15am UTC](https://discuss.elastic.co/t/how-can-i-start-many-logstash-conf-files-as-service/121834 "2018-03-26T07:15:22Z")
Logstash version: 5.0.1; when I have many logstash conf files, how can I start these conf files as soon as quickly? not start these conf files like : /path/logstash/bin/logstash -f /path/xxxx.conf Thx so much !!… --- ## [MAC address filter - OUI lookup](https://discuss.elastic.co/t/mac-address-filter-oui-lookup/125471)
**Author:** [@netmonky](https://discuss.elastic.co/u/netmonky)\ **Replies:** 3\ **Last updated:** [March 26, 2018, 6:48am UTC](https://discuss.elastic.co/t/mac-address-filter-oui-lookup/125471 "2018-03-26T06:48:41Z")
Hi everyone, Very new to elk, in fact, only just reading about it :). I do have a query around enrichment. If I had logs with MAC addresses in, is it possible to lookup the oui somewhere and add that as a attribute when… --- ## [Logstash 6.2.3 completely ignores configuration](https://discuss.elastic.co/t/logstash-6-2-3-completely-ignores-configuration/125223)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 6:17am UTC](https://discuss.elastic.co/t/logstash-6-2-3-completely-ignores-configuration/125223 "2018-03-26T06:17:48Z")
$ ./logstash --version logstash 6.2.3 $ cat /etc/logstash/conf.d/logstash.conf input { file { path =\> "/home/pkara/Desktop/mylogfile.log" } } output { stdout { } } $ cat /etc/logstash/pipelines.yml - pipeline.… --- ## [Exception in pipelineworker, the pipeline stopped processing new events,](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events/125543)
**Author:** [@Amit\_Hora](https://discuss.elastic.co/u/Amit_Hora)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 5:37am UTC](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events/125543 "2018-03-26T05:37:32Z")
Hi, Logstash stop processing new events after every 2 hours. Log file is filled with ERROR unable to reach host and then pipeline has stopped processing any new events \[2018-03-26T00:00:15,491\]\[ERROR\]\[logstash.outputs.… --- ## [Isolating Hashtags in Twitter Feed](https://discuss.elastic.co/t/isolating-hashtags-in-twitter-feed/125532)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 7\ **Last updated:** [March 26, 2018, 5:11am UTC](https://discuss.elastic.co/t/isolating-hashtags-in-twitter-feed/125532 "2018-03-26T05:11:26Z")
Maybe my best bet is to start with my end goal and then someone can tell me if this is possible. I'd like to build Kibana visuals that show top mentions of hashtags as they appear in the \[extended\_tweet\]\[full\_text\] fiel… --- ## [How to distinguish between two input data sources?](https://discuss.elastic.co/t/how-to-distinguish-between-two-input-data-sources/122209)
**Author:** [@linsie](https://discuss.elastic.co/u/linsie)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 3:07am UTC](https://discuss.elastic.co/t/how-to-distinguish-between-two-input-data-sources/122209 "2018-03-26T03:07:46Z")
Logstash version : 5.0.1 How to distinguish between two input data sources from different computers or systems, the input is used with tcp and the same port, like this : input { tcp { port =\> 514 } } for example : … --- ## [Http poller unable to login](https://discuss.elastic.co/t/http-poller-unable-to-login/125530)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 2:22am UTC](https://discuss.elastic.co/t/http-poller-unable-to-login/125530 "2018-03-26T02:22:42Z")
Hi, The url I'm trying to access looks like this: 192.168.1.1/web.cgi?netLoggedInUser=1. However the response I get is loggedin: "false". I think this is because the login page is not on the first page but on a separat… --- ## [Jdk8 run logstash6.2.2 error, jopenssl/load -- java.lang.VerifyError: class org.bouncycastle.asn1](https://discuss.elastic.co/t/jdk8-run-logstash6-2-2-error-jopenssl-load-java-lang-verifyerror-class-org-bouncycastle-asn1/125187)
**Author:** [@jackxueman](https://discuss.elastic.co/u/jackxueman)\ **Replies:** 4\ **Last updated:** [March 26, 2018, 1:23am UTC](https://discuss.elastic.co/t/jdk8-run-logstash6-2-2-error-jopenssl-load-java-lang-verifyerror-class-org-bouncycastle-asn1/125187 "2018-03-26T01:23:30Z")
Logstash - java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (LoadError) load error: jopenssl/load -- java.lang.VerifyError: class org.bouncycastle.asn1.ASN1Primitive overrides final method equals.(Lj… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=792) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=794)