# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=797 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 798 --- ## [Can't receive snmp trap](https://discuss.elastic.co/t/cant-receive-snmp-trap/124958)
**Author:** [@vdoraikannan](https://discuss.elastic.co/u/vdoraikannan)\ **Replies:** 0\ **Last updated:** [March 21, 2018, 10:12am UTC](https://discuss.elastic.co/t/cant-receive-snmp-trap/124958 "2018-03-21T10:12:35Z")
Logstash configuration file input { snmptrap { host =\> "0.0.0.0" port =\> 1062 type =\> "snmp\_trap" community =\> "public" } } output { elasticsearch { hosts =\> "localhost:9200" index =\> "%{\[@metadata\]\[beat\]}-%{… --- ## [Failed to load Pipelines.yml file in windows enviromment!](https://discuss.elastic.co/t/failed-to-load-pipelines-yml-file-in-windows-enviromment/124508)
**Author:** [@naveen\_K.N](https://discuss.elastic.co/u/naveen_K.N)\ **Replies:** 1\ **Last updated:** [March 21, 2018, 8:37am UTC](https://discuss.elastic.co/t/failed-to-load-pipelines-yml-file-in-windows-enviromment/124508 "2018-03-21T08:37:34Z")
Hi Elastic Team, im trying to create multiple pipelines using configuration in pipelines.yml file and hence running logstash in command prompt as " bin/logstash " so why am i getting error: Failed to read pipelines y… --- ## [Create two timestamp](https://discuss.elastic.co/t/create-two-timestamp/124932)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 0\ **Last updated:** [March 21, 2018, 8:31am UTC](https://discuss.elastic.co/t/create-two-timestamp/124932 "2018-03-21T08:31:27Z")
I have following parse log and it has 2 types of log time and I need to build 2 timestamp using them. { "log\_timestamp" =\> 2018-03-21T01:29:45.000Z, "year" =\> "2018", "day" =\> "Wed", "monthday" =\>… --- ## [Logstash with Filebeat i/o timeout](https://discuss.elastic.co/t/logstash-with-filebeat-i-o-timeout/121055)
**Author:** [@mschuster](https://discuss.elastic.co/u/mschuster)\ **Replies:** 1\ **Last updated:** [March 21, 2018, 7:33am UTC](https://discuss.elastic.co/t/logstash-with-filebeat-i-o-timeout/121055 "2018-03-21T07:33:42Z")
Hi all, i got some problems with filebeat and logstash. When i start logstash, all informations are going into elasticsearch, but after a short time i don´t see (most) informations from filebeat in kibana. In the logf… --- ## [Grok filter for custom logs](https://discuss.elastic.co/t/grok-filter-for-custom-logs/124918)
**Author:** [@mamta](https://discuss.elastic.co/u/mamta)\ **Replies:** 0\ **Last updated:** [March 21, 2018, 7:20am UTC](https://discuss.elastic.co/t/grok-filter-for-custom-logs/124918 "2018-03-21T07:20:35Z")
Hello All, I have used grok filter to structured my logs.But I am not able to get an output as expected.Can anyone please help me to filter this logs? Thank you so much in advance.... My logs input is as following br… --- ## [From Logdate generate @timestamp](https://discuss.elastic.co/t/from-logdate-generate-timestamp/124790)
**Author:** [@Invictus](https://discuss.elastic.co/u/Invictus)\ **Replies:** 2\ **Last updated:** [March 21, 2018, 6:57am UTC](https://discuss.elastic.co/t/from-logdate-generate-timestamp/124790 "2018-03-21T06:57:08Z")
Hi, i have a problem concerning the @timestamp. So the timestamp should be the date from the logs and not the time filebeat read somthing into ELK. Please find attached my Logs: 19.03.2018 19:50:55 Hostname : Message… --- ## [RE:Oracle DB for JDBC Plugin in Logstash](https://discuss.elastic.co/t/re-oracle-db-for-jdbc-plugin-in-logstash/124746)
**Author:** [@naveen\_K.N](https://discuss.elastic.co/u/naveen_K.N)\ **Replies:** 1\ **Last updated:** [March 21, 2018, 6:49am UTC](https://discuss.elastic.co/t/re-oracle-db-for-jdbc-plugin-in-logstash/124746 "2018-03-21T06:49:43Z")
Hello Elastic Team, im facing issue in connectivity to Oracle 12C DB using JDBC input Plugin available in Logstash, let me know the syntax for connection string, driver class and jar can be used for Oracle 12C. i have… --- ## [Multiple pipeline error](https://discuss.elastic.co/t/multiple-pipeline-error/124911)
**Author:** [@satya\_sandeep](https://discuss.elastic.co/u/satya_sandeep)\ **Replies:** 1\ **Last updated:** [March 21, 2018, 6:37am UTC](https://discuss.elastic.co/t/multiple-pipeline-error/124911 "2018-03-21T06:37:43Z")
Hi, I am working with a config it runs fine in local when i deploy in production i get the following error \[2018-03-21T06:21:51,024\]\[FATAL\]\[logstash.runner \] An unexpected error occurred! {:error=\>#\ **Author:** [@Mahi](https://discuss.elastic.co/u/Mahi)\ **Replies:** 3\ **Last updated:** [March 21, 2018, 12:26am UTC](https://discuss.elastic.co/t/read-filenames-using-logstash/124758 "2018-03-21T00:26:08Z") Hi All, I need to read to read filenames available in a directory in unix server and send it to elastic search to create dashboards in Kibana. Filename itself contains all the information that is required to create my d… --- ## [Archive raw logs and also output filtered logs](https://discuss.elastic.co/t/archive-raw-logs-and-also-output-filtered-logs/124774)
**Author:** [@hazzaap123](https://discuss.elastic.co/u/hazzaap123)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 7:52pm UTC](https://discuss.elastic.co/t/archive-raw-logs-and-also-output-filtered-logs/124774 "2018-03-20T19:52:43Z")
Hi, I'm trying to set up a pipeline that takes log input from Filebeat, outputs the raw logs to Amazon S3, AND filters the logs to then store in elastic. Is there currently a way to configure the s3 output plugin to onl… --- ## [Jdbc\_streaming - get clean target content - not the field name as well](https://discuss.elastic.co/t/jdbc-streaming-get-clean-target-content-not-the-field-name-as-well/124468)
**Author:** [@xmatt](https://discuss.elastic.co/u/xmatt)\ **Replies:** 0\ **Last updated:** [March 19, 2018, 12:34am UTC](https://discuss.elastic.co/t/jdbc-streaming-get-clean-target-content-not-the-field-name-as-well/124468 "2018-03-19T00:34:31Z")
Hi there, First post - I've spent a LONG time reading through the discuss posts and found as much as I can without posting my own question so THANKS for all the great info!! My question is directly linked to the follow… --- ## [How to create separate index for separate devices?](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 6\ **Last updated:** [March 20, 2018, 6:50pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410 "2018-03-20T18:50:30Z")
Hi there, I have around 8-10 devices which are sending logs to logstash over syslog. I need to if I can have separate index created per dvice? like logstash-router1-, logstash-firewall-, logstash-nginx-\* and so on? Wha… --- ## [Logstash not pushing flush onto pipeline](https://discuss.elastic.co/t/logstash-not-pushing-flush-onto-pipeline/124817)
**Author:** [@smbullet](https://discuss.elastic.co/u/smbullet)\ **Replies:** 0\ **Last updated:** [March 20, 2018, 4:24pm UTC](https://discuss.elastic.co/t/logstash-not-pushing-flush-onto-pipeline/124817 "2018-03-20T16:24:37Z")
I'm trying to debug one of my logstash machines that doesn't seem to be processing incoming syslog. I was reading this (https://www.elastic.co/guide/en/logstash/2.4/pipeline.html#\_fault\_tolerance) and noticed that my wor… --- ## [Filebeat of windows to elastic search instance on ubuntu](https://discuss.elastic.co/t/filebeat-of-windows-to-elastic-search-instance-on-ubuntu/124798)
**Author:** [@Prajakta\_Sonawane](https://discuss.elastic.co/u/Prajakta_Sonawane)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 6:23pm UTC](https://discuss.elastic.co/t/filebeat-of-windows-to-elastic-search-instance-on-ubuntu/124798 "2018-03-20T18:23:37Z")
I am trying to connect filebeat on windows to ES instance on ubuntu via logstash and getting the following error :\[logstash\] --- ## [Logstash - no response](https://discuss.elastic.co/t/logstash-no-response/124813)
**Author:** [@David\_Gabay](https://discuss.elastic.co/u/David_Gabay)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 6:18pm UTC](https://discuss.elastic.co/t/logstash-no-response/124813 "2018-03-20T18:18:34Z")
I'm trying to upload json files to Elastic via Logstash. When I run logstash, it connects to Elastic, declares that it's starting a pipeline, but doesn't seem to do anything. I tried to deliberately enter a non-exist… --- ## [FileBeat or Logstash for End of File Notification](https://discuss.elastic.co/t/filebeat-or-logstash-for-end-of-file-notification/124815)
**Author:** [@Omair\_Khalid](https://discuss.elastic.co/u/Omair_Khalid)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 6:16pm UTC](https://discuss.elastic.co/t/filebeat-or-logstash-for-end-of-file-notification/124815 "2018-03-20T18:16:37Z")
Hello, So we have a scenario where every day some files have been placed in a directory in a server. Now we just need to parse the files , extract relevant information from logs and send it to elasticsearch. The proble… --- ## [Put value of nested field into new field](https://discuss.elastic.co/t/put-value-of-nested-field-into-new-field/124522)
**Author:** [@LEK-LD](https://discuss.elastic.co/u/LEK-LD)\ **Replies:** 10\ **Last updated:** [March 20, 2018, 6:14pm UTC](https://discuss.elastic.co/t/put-value-of-nested-field-into-new-field/124522 "2018-03-20T18:14:16Z")
Hello there, i'm trying to put a value of a nested field into a new field by the help of logstash filters. I thought that the mutate-filter would be suitable for that. So here's what i'm trying to do: Log4J parses a L… --- ## [In RHEL how to run Configuration file along with logstash?](https://discuss.elastic.co/t/in-rhel-how-to-run-configuration-file-along-with-logstash/121479)
**Author:** [@naveen\_K.N](https://discuss.elastic.co/u/naveen_K.N)\ **Replies:** 43\ **Last updated:** [March 20, 2018, 2:51pm UTC](https://discuss.elastic.co/t/in-rhel-how-to-run-configuration-file-along-with-logstash/121479 "2018-03-20T14:51:52Z")
Hi ELK team, i have successfully installed Logstash in RHEL. but what issue is we want to run Config file placed under config.d folder when we run "sudo initctl start logstash ". it is not reading those config files pl… --- ## [LS output failed](https://discuss.elastic.co/t/ls-output-failed/123923)
**Author:** [@wakame](https://discuss.elastic.co/u/wakame)\ **Replies:** 5\ **Last updated:** [March 20, 2018, 3:59pm UTC](https://discuss.elastic.co/t/ls-output-failed/123923 "2018-03-20T15:59:04Z")
I'm seeing the following INFO message, the connection to Kafka is lost and I'm unable to connect to it. 2018-03-14T14:13:02,743\]\[INFO \]\[logstash.outputs.kafka \] Sending batch to Kafka failed. Will retry after a delay. {… --- ## [Csv filter ConfigurationError logstash 6.2.2](https://discuss.elastic.co/t/csv-filter-configurationerror-logstash-6-2-2/124761)
**Author:** [@Basem\_Mohammed](https://discuss.elastic.co/u/Basem_Mohammed)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 3:31pm UTC](https://discuss.elastic.co/t/csv-filter-configurationerror-logstash-6-2-2/124761 "2018-03-20T15:31:27Z")
I am trying to use the CSV filter to read csv file. First of all, I used an input file plug-in to read the file. Then, I used CSV to add columns. But I got a very strange error message in the character that follows the… --- ## [Logstash updating index with redudent data](https://discuss.elastic.co/t/logstash-updating-index-with-redudent-data/124803)
**Author:** [@TechGeek](https://discuss.elastic.co/u/TechGeek)\ **Replies:** 0\ **Last updated:** [March 20, 2018, 3:10pm UTC](https://discuss.elastic.co/t/logstash-updating-index-with-redudent-data/124803 "2018-03-20T15:10:07Z")
When I copied (Ctrl +C, Ctrl +V) the new records(two times new records) in .csv (Which is my input file), logstash read the changes along with old records. First time insert of records:- I added 50 records, everything … --- ## [Custom JDK for Logstash](https://discuss.elastic.co/t/custom-jdk-for-logstash/124422)
**Author:** [@qube](https://discuss.elastic.co/u/qube)\ **Replies:** 10\ **Last updated:** [March 20, 2018, 3:01pm UTC](https://discuss.elastic.co/t/custom-jdk-for-logstash/124422 "2018-03-20T15:01:49Z")
Hello! According to this answer, I extracted the exe file (I'm windows user) and copied the necessary files. For Elasticsearch, it worked. I set java\_home variable in the elasticsearch.bat set JAVA\_HOME=path/to/jdk/fil… --- ## [Logstash command line](https://discuss.elastic.co/t/logstash-command-line/124373)
**Author:** [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Replies:** 8\ **Last updated:** [March 20, 2018, 2:53pm UTC](https://discuss.elastic.co/t/logstash-command-line/124373 "2018-03-20T14:53:47Z")
I need to lunch the command logstash -f test.conf with python script from another terminal. So I'd like to lunch the command logstash -f test.conf and then I'd like to have the possibility to lunch other command. Instea… --- ## [Persistent queue enabled - Version mismatch](https://discuss.elastic.co/t/persistent-queue-enabled-version-mismatch/124788)
**Author:** [@venkat1234](https://discuss.elastic.co/u/venkat1234)\ **Replies:** 0\ **Last updated:** [March 20, 2018, 2:30pm UTC](https://discuss.elastic.co/t/persistent-queue-enabled-version-mismatch/124788 "2018-03-20T14:30:45Z")
Running ELK 5.6.5 with persistent queue enabled in logstash.yml running on centos 7.1 queue.type: persisted queue.max\_events: 50 Run into following exception frequently org.logstash.ackedqueue.io.AbstractByteBufferPa… --- ## [Logstash log4j configuration (log input id)](https://discuss.elastic.co/t/logstash-log4j-configuration-log-input-id/124616)
**Author:** [@franck.lefebure](https://discuss.elastic.co/u/franck.lefebure)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 2:27pm UTC](https://discuss.elastic.co/t/logstash-log4j-configuration-log-input-id/124616 "2018-03-20T14:27:06Z")
Hello, I have pipelines with dozen of inputs/filters For some jdbc input, i meet errors : \[2018-03-19T13:19:00,524\]\[ERROR\]\[logstash.inputs.jdbc \] Unable to connect to database. Tried 1 times {:error\_message=\>"Jav… --- ## [\_grokparsefailure using regex filter with multiline codec](https://discuss.elastic.co/t/grokparsefailure-using-regex-filter-with-multiline-codec/123949)
**Author:** [@martin.g](https://discuss.elastic.co/u/martin.g)\ **Replies:** 4\ **Last updated:** [March 20, 2018, 2:07pm UTC](https://discuss.elastic.co/t/grokparsefailure-using-regex-filter-with-multiline-codec/123949 "2018-03-20T14:07:36Z")
Hi all, i am trying to parse in Logstash 6.2.2 this log: --- BEGIN ----- 4.3.2018 13:29:26.286 --- Identification: ABC\_a1262e23-74a3-4f57-bd79-ee025805bee5 (c0cc8fa7-d8ad-4cda-8a27-c1af03794ca0) Message: Get signed d… --- ## [Filter not "fireing" being bypassed](https://discuss.elastic.co/t/filter-not-fireing-being-bypassed/124781)
**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\ **Replies:** 0\ **Last updated:** [March 20, 2018, 1:57pm UTC](https://discuss.elastic.co/t/filter-not-fireing-being-bypassed/124781 "2018-03-20T13:57:08Z")
windows environment beats input from windows event forwarder server. data is comming in not problem but the filter seems to be circumvented. the config was written for linux ubuntu, input { beats { port =\> 5044 add\_f… --- ## [Syslog input plugin is not working correctly](https://discuss.elastic.co/t/syslog-input-plugin-is-not-working-correctly/124773)
**Author:** [@David\_Gidony](https://discuss.elastic.co/u/David_Gidony)\ **Replies:** 0\ **Last updated:** [March 20, 2018, 1:29pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-is-not-working-correctly/124773 "2018-03-20T13:29:24Z")
hi, im trying to recieve syslog messages with logstash, i have configured the following conf file: input { tcp { port =\> 514 type =\> syslog } udp { port =\> 514 type =\> syslog } } filter { if… --- ## [Split not splitting?](https://discuss.elastic.co/t/split-not-splitting/124601)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 3\ **Last updated:** [March 20, 2018, 12:42pm UTC](https://discuss.elastic.co/t/split-not-splitting/124601 "2018-03-20T12:42:35Z")
We want to split a URL into it's path components and apply some logic based on parts of the URL. Filter: mutate { copy =\> {"url" =\> "path"} split =\> {"path" =\> "/"} } Result: { ... "url" =\> "/foo/bar/207… --- ## [Logstash-csv filter](https://discuss.elastic.co/t/logstash-csv-filter/124759)
**Author:** [@paresh\_Panda](https://discuss.elastic.co/u/paresh_Panda)\ **Replies:** 0\ **Last updated:** [March 20, 2018, 12:30pm UTC](https://discuss.elastic.co/t/logstash-csv-filter/124759 "2018-03-20T12:30:41Z")
Hi, I am trying Logstash csv filter to put csv data into elastic search. There is a chance that new csv fields will be added in future. I am looking for an option where by deafult the new fields are converted as integer… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=796) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=798)