# Logstash

**URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=796

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 797

---

## [Want to add duration (in seconds) to timestamp](https://discuss.elastic.co/t/want-to-add-duration-in-seconds-to-timestamp/125003)

<div class="topic-metadata">

**Author:** [@MarBel78](https://discuss.elastic.co/u/MarBel78)\
**Replies:** 2\
**Last updated:** [March 22, 2018, 12:00pm UTC](https://discuss.elastic.co/t/want-to-add-duration-in-seconds-to-timestamp/125003 "2018-03-22T12:00:44Z")

</div>

Dear all, i want to add a given durations (in seconds) to timestamp into a new field. In the end, i have the start time (timestamp) and the end time. What is the easiest way during import by logstash ? Thanks a lot!

---

## [Logstash - translate issue](https://discuss.elastic.co/t/logstash-translate-issue/124749)

<div class="topic-metadata">

**Author:** [@Pedro\_Cabral](https://discuss.elastic.co/u/Pedro_Cabral)\
**Replies:** 2\
**Last updated:** [March 22, 2018, 11:25am UTC](https://discuss.elastic.co/t/logstash-translate-issue/124749 "2018-03-22T11:25:50Z")

</div>

Hello all, I have the following configuration: filter { if \[type\] == "bro-conn" { #The following makes use of the translate filter (logstash contrib) to convert conn\_state into human text. Saves having to loo…

---

## [How to add a ruby code inside of the logstash config file?](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965)

<div class="topic-metadata">

**Author:** [@Yusuf\_Karatoprak](https://discuss.elastic.co/u/Yusuf_Karatoprak)\
**Replies:** 3\
**Last updated:** [March 22, 2018, 11:24am UTC](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965 "2018-03-22T11:24:03Z")

</div>

I try to send logs to windows event by using logstash. After added some ruby code;it is created below error.How can I send logs to windows event? input { file { type =\> "json" path =\> \["C:/Temp/logs/\*.json"\] start\_p…

---

## [Issue: Failed to create monitoring event](https://discuss.elastic.co/t/issue-failed-to-create-monitoring-event/125109)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 2\
**Last updated:** [March 22, 2018, 10:17am UTC](https://discuss.elastic.co/t/issue-failed-to-create-monitoring-event/125109 "2018-03-22T10:17:31Z")

</div>

Seeing the following error after running the logstash. \[2018-03-13T03:30:07,882\]\[ERROR\]\[logstash.inputs.metrics \] Failed to create monitoring event {:message=\>"For path: events", :error=\>"LogStash::Instrument::MetricSt…

---

## [Nbr of docs is different for the same data](https://discuss.elastic.co/t/nbr-of-docs-is-different-for-the-same-data/125135)

<div class="topic-metadata">

**Author:** [@NOUR](https://discuss.elastic.co/u/NOUR)\
**Replies:** 0\
**Last updated:** [March 22, 2018, 8:36am UTC](https://discuss.elastic.co/t/nbr-of-docs-is-different-for-the-same-data/125135 "2018-03-22T08:36:32Z")

</div>

Hello, \[image\] I wana ask you about the nbr of docs why is different even i use the same data for the 2 index ? I have a look at the elastic log , i found this information: \[image\] AT 13:35 , the PC was screen saver…

---

## [Matching conditions not working](https://discuss.elastic.co/t/matching-conditions-not-working/125119)

<div class="topic-metadata">

**Author:** [@hansis100](https://discuss.elastic.co/u/hansis100)\
**Replies:** 0\
**Last updated:** [March 22, 2018, 7:40am UTC](https://discuss.elastic.co/t/matching-conditions-not-working/125119 "2018-03-22T07:40:27Z")

</div>

Hello! I have a logfile that I want to parse with grok \<result\>;\<short message\>;\<long message\>;\<scriptname\>;\<performance\> \<result\>: \[OK|WARNING|ERRROR\] \<short message\> short Info \<long message\>: Err…

---

## [Cloud foundry wihh Logstash](https://discuss.elastic.co/t/cloud-foundry-wihh-logstash/125049)

<div class="topic-metadata">

**Author:** [@bhushanrade](https://discuss.elastic.co/u/bhushanrade)\
**Replies:** 1\
**Last updated:** [March 22, 2018, 7:31am UTC](https://discuss.elastic.co/t/cloud-foundry-wihh-logstash/125049 "2018-03-22T07:31:44Z")

</div>

in logstash for cloud foundry i used tcp and udp input plugin as below input { tcp { port =\> 5000 type =\> syslog } udp { port =\> 5000 type =\> syslog } } but i'm looking data resilient(persistent queue) feature…

---

## [Start warinnig](https://discuss.elastic.co/t/start-warinnig/124692)

<div class="topic-metadata">

**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Replies:** 9\
**Last updated:** [March 22, 2018, 6:55am UTC](https://discuss.elastic.co/t/start-warinnig/124692 "2018-03-22T06:55:58Z")

</div>

\[2018-03-20T14:25:23,077\]\[INFO \]\[logstash.pipeline \] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>16, "pipeline.batch.size"=\>12500, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>200000} \[2018-03-20T…

---

## [Got a bad response code from server, but this code is not considered retryable](https://discuss.elastic.co/t/got-a-bad-response-code-from-server-but-this-code-is-not-considered-retryable/124487)

<div class="topic-metadata">

**Author:** [@wentao](https://discuss.elastic.co/u/wentao)\
**Replies:** 3\
**Last updated:** [March 22, 2018, 6:54am UTC](https://discuss.elastic.co/t/got-a-bad-response-code-from-server-but-this-code-is-not-considered-retryable/124487 "2018-03-22T06:54:10Z")

</div>

hello,i have a question when i use the logstash. everythind looks ok, but my data of my kibana is slower and slower.There is an hour gap now，eg：now time is 8:20，but the data of kibana only show up to 7:32.Simultaneously…

---

## [Geopoint lat and lot error](https://discuss.elastic.co/t/geopoint-lat-and-lot-error/125091)

<div class="topic-metadata">

**Author:** [@strong666](https://discuss.elastic.co/u/strong666)\
**Replies:** 1\
**Last updated:** [March 22, 2018, 5:27am UTC](https://discuss.elastic.co/t/geopoint-lat-and-lot-error/125091 "2018-03-22T05:27:27Z")

</div>

I have a location in the database table fields, the format of the data is stored inside is a string, such as: 108.714931, 34.3380499, (the longitude and latitude), but I see documents, geo\_point was a string format, is t…

---

## [Logstash VS Filebeat](https://discuss.elastic.co/t/logstash-vs-filebeat/124988)

<div class="topic-metadata">

**Author:** [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Replies:** 3\
**Last updated:** [March 22, 2018, 4:14am UTC](https://discuss.elastic.co/t/logstash-vs-filebeat/124988 "2018-03-22T04:14:37Z")

</div>

HI, I have a doubt why i should use a file beat ?? what is the use of file beat ?? when logstash is able to fetch to fetch the logs. let me describe a scenario i have an application running in the server (A) and its l…

---

## [Logstash filter problem](https://discuss.elastic.co/t/logstash-filter-problem/124912)

<div class="topic-metadata">

**Author:** [@Mango](https://discuss.elastic.co/u/Mango)\
**Replies:** 2\
**Last updated:** [March 22, 2018, 3:34am UTC](https://discuss.elastic.co/t/logstash-filter-problem/124912 "2018-03-22T03:34:33Z")

</div>

I have one log file with two different format, And now, I want to match them together ,and I write logstash-filter in below way. filter{ if \[type\] == "test" { grok { match =\> {"message" =\> "%{WORD:lo…

---

## [Reading logfile but no result](https://discuss.elastic.co/t/reading-logfile-but-no-result/124916)

<div class="topic-metadata">

**Author:** [@cui\_qin](https://discuss.elastic.co/u/cui_qin)\
**Replies:** 1\
**Last updated:** [March 22, 2018, 2:16am UTC](https://discuss.elastic.co/t/reading-logfile-but-no-result/124916 "2018-03-22T02:16:27Z")

</div>

Hi, I am using 5.6.8 logstash/elastic in Ubuntu12. run the following commands: ./bin/logstash -f logstash.conf logstash.conf : input { file { path =\> "/tmp/access" } } filter { grok { match =\> { "message"…

---

## [Could not index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/124672)

<div class="topic-metadata">

**Author:** [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Replies:** 7\
**Last updated:** [March 22, 2018, 1:42am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/124672 "2018-03-22T01:42:51Z")

</div>

This is my json item, \[47\] And this is my config input { file { path =\> "/Users/apple/Desktop/RiskComb/RiskComb.json" start\_position =\> "beginning" sincedb\_path =\> "/Users/apple/Desktop/RiskComb/read\_pos.txt" …

---

## [Date format rejected, no apparent reason why](https://discuss.elastic.co/t/date-format-rejected-no-apparent-reason-why/125082)

<div class="topic-metadata">

**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\
**Replies:** 1\
**Last updated:** [March 22, 2018, 1:38am UTC](https://discuss.elastic.co/t/date-format-rejected-no-apparent-reason-why/125082 "2018-03-22T01:38:30Z")

</div>

Hello, I am trying to understand the following error: The main problem is at the bottom of the error: Invalid format: \\"2018-03-11 02:48:31\\" is malformed at \\" 02:48:31\\" \[2018-03-21T15:59:35,601\]\[WARN \]\[logstash.out…

---

## [SQL and elasticsearch](https://discuss.elastic.co/t/sql-and-elasticsearch/124886)

<div class="topic-metadata">

**Author:** [@kanthimathi](https://discuss.elastic.co/u/kanthimathi)\
**Replies:** 2\
**Last updated:** [March 21, 2018, 8:57pm UTC](https://discuss.elastic.co/t/sql-and-elasticsearch/124886 "2018-03-21T20:57:33Z")

</div>

Hi all, Planning to find out the possibilities of implementing elastic search to connect with databases and use kibana as a visualization tool. As we already use elastic search for logging I am aware of the visualizatio…

---

## [Docker: where to find dockerfile or how to deal with java updates?](https://discuss.elastic.co/t/docker-where-to-find-dockerfile-or-how-to-deal-with-java-updates/124930)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 1\
**Last updated:** [March 21, 2018, 8:55pm UTC](https://discuss.elastic.co/t/docker-where-to-find-dockerfile-or-how-to-deal-with-java-updates/124930 "2018-03-21T20:55:35Z")

</div>

Hi, I am thinking about deploying logstash as docker container in future in production. In the past we did not update elastic stack often. In general we hop from major to major version but miss the minor updates. Curre…

---

## [Filebeat on windows to ES instance on Ubuntu](https://discuss.elastic.co/t/filebeat-on-windows-to-es-instance-on-ubuntu/124793)

<div class="topic-metadata">

**Author:** [@kanchan\_pingale](https://discuss.elastic.co/u/kanchan_pingale)\
**Replies:** 4\
**Last updated:** [March 21, 2018, 8:35pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-to-es-instance-on-ubuntu/124793 "2018-03-21T20:35:41Z")

</div>

I am trying to connect Filebeat on windows to ES instance on Ubuntu via Logstash. The error which I got is : \[logstash\] Its not getting connected ! ANd even logstash is getting terminated!

---

## [Data going into wrong index-why](https://discuss.elastic.co/t/data-going-into-wrong-index-why/124869)

<div class="topic-metadata">

**Author:** [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\
**Replies:** 14\
**Last updated:** [March 21, 2018, 8:34pm UTC](https://discuss.elastic.co/t/data-going-into-wrong-index-why/124869 "2018-03-21T20:34:26Z")

</div>

Hello Experts, Different type of logs going into single index, technically it should go to different new (defined) indexes. I am differentiating 2 different log files with TAG and then applying filter on TAG in logstas…

---

## [Logstash Filter Theory](https://discuss.elastic.co/t/logstash-filter-theory/124883)

<div class="topic-metadata">

**Author:** [@wendt](https://discuss.elastic.co/u/wendt)\
**Replies:** 4\
**Last updated:** [March 21, 2018, 8:26pm UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883 "2018-03-21T20:26:05Z")

</div>

Do mutate functions build on each other? For example, if I were to rename a field and then wanted to send the text of that field to lower case, would I use the name of the original field, or the renamed version? Ex. sta…

---

## [Fail to install beat plugin](https://discuss.elastic.co/t/fail-to-install-beat-plugin/124693)

<div class="topic-metadata">

**Author:** [@fchang](https://discuss.elastic.co/u/fchang)\
**Replies:** 3\
**Last updated:** [March 21, 2018, 8:14pm UTC](https://discuss.elastic.co/t/fail-to-install-beat-plugin/124693 "2018-03-21T20:14:26Z")

</div>

Hello, I've download logstash-input-beats-master.zip from https://github.com/logstash-plugins/logstash-input-beats however installation got failed as below. Could anyone help me please? ./logstash-plugin install file:/…

---

## [How to tell if "tags" array is empty in LS 6](https://discuss.elastic.co/t/how-to-tell-if-tags-array-is-empty-in-ls-6/121357)

<div class="topic-metadata">

**Author:** [@nick-george](https://discuss.elastic.co/u/nick-george)\
**Replies:** 4\
**Last updated:** [March 21, 2018, 8:11pm UTC](https://discuss.elastic.co/t/how-to-tell-if-tags-array-is-empty-in-ls-6/121357 "2018-03-21T20:11:33Z")

</div>

Hi, The code here (How can I check if the "tags" array is empty?) used to work for checking if tags was empty or not. if \[tags\] == \[\] { mutate { remove\_field =\> \["tags"\] } } Unfortunately, it no longer seems t…

---

## [Metricbeat not sending information to Logstash](https://discuss.elastic.co/t/metricbeat-not-sending-information-to-logstash/124996)

<div class="topic-metadata">

**Author:** [@vaishali1](https://discuss.elastic.co/u/vaishali1)\
**Replies:** 5\
**Last updated:** [March 21, 2018, 4:25pm UTC](https://discuss.elastic.co/t/metricbeat-not-sending-information-to-logstash/124996 "2018-03-21T16:25:41Z")

</div>

Metricbeat not sending information to Logstash Output: Sending Logstash's logs to C:/Users/328347935/Downloads/EKL/logstash-6.2.2/logstash-6.2.2/logs which is now configured v ia log4j2.properties \[2018-03-21T09:23:2…

---

## [Logstash not logging to /var/log](https://discuss.elastic.co/t/logstash-not-logging-to-var-log/125013)

<div class="topic-metadata">

**Author:** [@hgpit](https://discuss.elastic.co/u/hgpit)\
**Replies:** 1\
**Last updated:** [March 21, 2018, 3:47pm UTC](https://discuss.elastic.co/t/logstash-not-logging-to-var-log/125013 "2018-03-21T15:47:15Z")

</div>

Hello, I am brand new to logstash 6.2.3 and struggling with some basics. I have installed it onto CentOS7. If I run 'systemctl start logstash', I get nothing output to /var/log/logstash/ (but 'systemctl status logstash'…

---

## [Logstash on Windows - Multiple Pipeline Problem](https://discuss.elastic.co/t/logstash-on-windows-multiple-pipeline-problem/124846)

<div class="topic-metadata">

**Author:** [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Replies:** 18\
**Last updated:** [March 21, 2018, 3:12pm UTC](https://discuss.elastic.co/t/logstash-on-windows-multiple-pipeline-problem/124846 "2018-03-21T15:12:22Z")

</div>

Is it possible to run multiple pipelines on the Windows version of Logstash? I can’t seem to get this to work for the life of me. I have installed Logstash on Windows, and placed a pipelines.yml file in C:\\Program Files…

---

## [Different Apache access log formats!](https://discuss.elastic.co/t/different-apache-access-log-formats/124748)

<div class="topic-metadata">

**Author:** [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\
**Replies:** 1\
**Last updated:** [March 21, 2018, 2:53pm UTC](https://discuss.elastic.co/t/different-apache-access-log-formats/124748 "2018-03-21T14:53:00Z")

</div>

After setup my Logging System and start shipping some Apache access logs from 3 servers to my ELK Server. In Kibana discover page I have some log records they have parsed values for response, request, OS, verb, and agent…

---

## [How to install multiline plugin (Ubuntu 17.10)?](https://discuss.elastic.co/t/how-to-install-multiline-plugin-ubuntu-17-10/124975)

<div class="topic-metadata">

**Author:** [@solo](https://discuss.elastic.co/u/solo)\
**Replies:** 0\
**Last updated:** [March 21, 2018, 11:49am UTC](https://discuss.elastic.co/t/how-to-install-multiline-plugin-ubuntu-17-10/124975 "2018-03-21T11:49:39Z")

</div>

Hi, I have created a filter that uses multiline plugin in logstash, but how can I install the multiline filter plugin? I use Ubuntu 17.10. This is my error: Tried to load a plugin's code, but failed. {:exception=\>#\<L…

---

## [Keep default mapping type for any field as integer](https://discuss.elastic.co/t/keep-default-mapping-type-for-any-field-as-integer/123899)

<div class="topic-metadata">

**Author:** [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Replies:** 6\
**Last updated:** [March 21, 2018, 11:36am UTC](https://discuss.elastic.co/t/keep-default-mapping-type-for-any-field-as-integer/123899 "2018-03-21T11:36:00Z")

</div>

Hi, I have many fields (~800) in my CSV file. Most are integers while few are strings. I do have a mapping file where I list the type. But it is not feasible to list every field and its type since it keeps getting upda…

---

## [Logstash daily indexing](https://discuss.elastic.co/t/logstash-daily-indexing/124259)

<div class="topic-metadata">

**Author:** [@sana](https://discuss.elastic.co/u/sana)\
**Replies:** 2\
**Last updated:** [March 21, 2018, 11:31am UTC](https://discuss.elastic.co/t/logstash-daily-indexing/124259 "2018-03-21T11:31:08Z")

</div>

i have a few folders containes log files and each end of the day a new file is added to each folder my configuration file is this: file { path =\> "/home/sana/pfe/docker/logs/\*\*/\*.log" type =\> "syslog" start\_position =\>…

---

## [Match field to string in IF statement](https://discuss.elastic.co/t/match-field-to-string-in-if-statement/124956)

<div class="topic-metadata">

**Author:** [@No\_Executable](https://discuss.elastic.co/u/No_Executable)\
**Replies:** 1\
**Last updated:** [March 21, 2018, 10:45am UTC](https://discuss.elastic.co/t/match-field-to-string-in-if-statement/124956 "2018-03-21T10:45:22Z")

</div>

I am trying to push different log types through the same logstash config file. I have managed to get the log type from the path and filename into a separate field and now I want it to run different sets of configurations…

[Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=795)

[Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=797)