# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=800 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 801 --- ## [IF with multiple OR](https://discuss.elastic.co/t/if-with-multiple-or/123928)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 9\ **Last updated:** [March 16, 2018, 11:45pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928 "2018-03-16T23:45:15Z")
I have multiple fields that I need to check and, if they meet a shared value, it needs to be mutated. Is it possible to do something like this: if "pass" in \[field1\] or \[field2\] or \[field3\] { mutate { replace "%{… --- ## [Question about s3 output plugin](https://discuss.elastic.co/t/question-about-s3-output-plugin/124321)
**Author:** [@analyst3292](https://discuss.elastic.co/u/analyst3292)\ **Replies:** 4\ **Last updated:** [March 16, 2018, 7:53pm UTC](https://discuss.elastic.co/t/question-about-s3-output-plugin/124321 "2018-03-16T19:53:10Z")
Is it normal for the files logstash puts to s3 to be the raw log file, no parsing? It would seem that the s3 output discards any work done by the filters. \[root@sysmanage logstash-docker\]# cat pipeline/logstash.conf… --- ## [Writing GROK for tomcat logs](https://discuss.elastic.co/t/writing-grok-for-tomcat-logs/124263)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 7:04pm UTC](https://discuss.elastic.co/t/writing-grok-for-tomcat-logs/124263 "2018-03-16T19:04:21Z")
Am trying to parse Tomcat logs using GROK filter my logs has the below format 03/14/18 02:01:26 Event Created in BPPM: 512461 in 6ms The last field 6ms field is average response time of the app which i want to have as … --- ## [Start logstash after debian package installation](https://discuss.elastic.co/t/start-logstash-after-debian-package-installation/124282)
**Author:** [@MaesS](https://discuss.elastic.co/u/MaesS)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 7:03pm UTC](https://discuss.elastic.co/t/start-logstash-after-debian-package-installation/124282 "2018-03-16T19:03:19Z")
My goal here is to create a graph from the data in a csv file. I've installed Elasticsearch, Kibana and Logstash on an Ubuntu 16.04 server, all via the debian package. Now some tutorial I'm following is telling me i can … --- ## [Store XML to Index in ES using logstash](https://discuss.elastic.co/t/store-xml-to-index-in-es-using-logstash/124158)
**Author:** [@Galileo](https://discuss.elastic.co/u/Galileo)\ **Replies:** 10\ **Last updated:** [March 16, 2018, 6:31pm UTC](https://discuss.elastic.co/t/store-xml-to-index-in-es-using-logstash/124158 "2018-03-16T18:31:36Z")
This would be my first code in logstash My config file is shared below, im using ver. 5.6.4 input { file { path =\> ""sample.xml"" start\_position =\> ""beginning"" sincedb\_path =\> ""/dev/null"" } } filter { xml … --- ## [LogStatsh- Grok Filter for Special character in the log file](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360)
**Author:** [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\ **Replies:** 8\ **Last updated:** [March 16, 2018, 4:10pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360 "2018-03-16T16:10:53Z")
Hi, I have the below log pattern in a single line and trying to filter this from massive log using GROK FIlter 2018-02-17 17:00:12.7280 Information |||| Application: Hyperion |||| User: Teddy |||| Template: Homepage |… --- ## [Perform date math calculation inside elasticsearch filter plugin](https://discuss.elastic.co/t/perform-date-math-calculation-inside-elasticsearch-filter-plugin/123581)
**Author:** [@mirkomirko](https://discuss.elastic.co/u/mirkomirko)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 4:10pm UTC](https://discuss.elastic.co/t/perform-date-math-calculation-inside-elasticsearch-filter-plugin/123581 "2018-03-16T16:10:49Z")
Hi guys, I'm stucked in trying to perform some date math inside logstash. In particular, for a specific event, I've to query elastic and retrieve all documents that are in a range of 30 minutes from the time written insi… --- ## [Logstash filter for Jboss Fuse 6.2.1](https://discuss.elastic.co/t/logstash-filter-for-jboss-fuse-6-2-1/124116)
**Author:** [@solo](https://discuss.elastic.co/u/solo)\ **Replies:** 4\ **Last updated:** [March 16, 2018, 3:06pm UTC](https://discuss.elastic.co/t/logstash-filter-for-jboss-fuse-6-2-1/124116 "2018-03-16T15:06:39Z")
I've tried to create a filter for Logstash that can consume my Jboss Fuse log file. My filter is working, and I get data into Kibana. But I was wondering if is possible to split the message into: -Date -Message Type … --- ## [XML filter issue](https://discuss.elastic.co/t/xml-filter-issue/124012)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 8\ **Last updated:** [March 15, 2018, 5:46pm UTC](https://discuss.elastic.co/t/xml-filter-issue/124012 "2018-03-15T17:46:09Z")
I am getting started with the XML filter plugin. Here is my config: filter { xml { source =\> "message" store\_xml =\> false } } Ideally I want to have Logstash just convert the XML to JSON (ie. convert all th… --- ## [XML XPath filter is parsing fields but not inserting in Elasticsearch](https://discuss.elastic.co/t/xml-xpath-filter-is-parsing-fields-but-not-inserting-in-elasticsearch/123910)
**Author:** [@Vaibhav\_Palve](https://discuss.elastic.co/u/Vaibhav_Palve)\ **Replies:** 8\ **Last updated:** [March 14, 2018, 7:42pm UTC](https://discuss.elastic.co/t/xml-xpath-filter-is-parsing-fields-but-not-inserting-in-elasticsearch/123910 "2018-03-14T19:42:11Z")
Hi @magnusbaeck I am trying to parse the below xml to insert records in Elasticsearch : \ \ \Value1\ \Value2\ \0001\ \01-01-2016 09:00:00\ \ \ **Author:** [@Debashis\_Adak](https://discuss.elastic.co/u/Debashis_Adak)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 1:31pm UTC](https://discuss.elastic.co/t/problem-in-parsing-date/124296 "2018-03-16T13:31:25Z") Hi, I am facing an unique problem. I have a server in USA which is generating with timestamp like "\" Can anyone tell me how to handle UTC part? The date is already in UTC and I don't want t… --- ## [Logstash is processing logs which are already processed before on some later date](https://discuss.elastic.co/t/logstash-is-processing-logs-which-are-already-processed-before-on-some-later-date/124129)
**Author:** [@aniketkk](https://discuss.elastic.co/u/aniketkk)\ **Replies:** 3\ **Last updated:** [March 16, 2018, 12:04pm UTC](https://discuss.elastic.co/t/logstash-is-processing-logs-which-are-already-processed-before-on-some-later-date/124129 "2018-03-16T12:04:50Z")
Hi, I am using Nginx as my app server. I have installed filebeat where Nginx is installed. Filebeat pushes these logs to Logstash. Then logstash pushes forward to elasticsearch. This setup used to work perfectly fine. … --- ## [Can give a examplge about how logstash use udp data to es?](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 16\ **Last updated:** [March 16, 2018, 10:47am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661 "2018-03-16T10:47:19Z")
can give a example about use udp data ? how configure logstash with udp data as port 3232 input dat from as port 3242 , how filter configure how output to es configure. give me a example it's about the .conf file s… --- ## [Logstash-XML parser](https://discuss.elastic.co/t/logstash-xml-parser/121641)
**Author:** [@rattisyam](https://discuss.elastic.co/u/rattisyam)\ **Replies:** 12\ **Last updated:** [March 16, 2018, 10:30am UTC](https://discuss.elastic.co/t/logstash-xml-parser/121641 "2018-03-16T10:30:03Z")
Hi, I am new to ELK. I am trying to parse jenkins build.xml and collecting output using elastic search. I am using codec =\> multiline for the input to get it as a single event but i could not able to get tag in the m… --- ## [Log date having Month Day and time only | Filter for logstash](https://discuss.elastic.co/t/log-date-having-month-day-and-time-only-filter-for-logstash/124241)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 9:37am UTC](https://discuss.elastic.co/t/log-date-having-month-day-and-time-only-filter-for-logstash/124241 "2018-03-16T09:37:14Z")
I found IPS log which is having only Month Day and time fields as below sample log \<130\>Mar 15 07:27:29 SyslogAlertForwarder: I need build a standard timestamp using above log under logstash filter as below. 2018-03-1… --- ## [Multiple pipelines or single pipeline](https://discuss.elastic.co/t/multiple-pipelines-or-single-pipeline/124228)
**Author:** [@Salma](https://discuss.elastic.co/u/Salma)\ **Replies:** 0\ **Last updated:** [March 16, 2018, 8:11am UTC](https://discuss.elastic.co/t/multiple-pipelines-or-single-pipeline/124228 "2018-03-16T08:11:36Z")
Hi, I'm working on a project that collects log files from multiple sources such as s3 and local server. For the s3 part, I've connected the Logstash directly to the bucket, and for the local server I'm using Filebeat t… --- ## [Pipeline to ingest data from multiple files in a folder - not responsive](https://discuss.elastic.co/t/pipeline-to-ingest-data-from-multiple-files-in-a-folder-not-responsive/124167)
**Author:** [@jason\_smith](https://discuss.elastic.co/u/jason_smith)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 7:06am UTC](https://discuss.elastic.co/t/pipeline-to-ingest-data-from-multiple-files-in-a-folder-not-responsive/124167 "2018-03-16T07:06:10Z")
I am trying to ingest multiple files in a folder into Elasticsearch. I am using ELK 6.0 version on windows 8 OS. logstash -f ingestcars.config command is non-responsive. The log says "pipeline is running". If I try to … --- ## [Multi line CSV Log](https://discuss.elastic.co/t/multi-line-csv-log/124174)
**Author:** [@millerb1](https://discuss.elastic.co/u/millerb1)\ **Replies:** 2\ **Last updated:** [March 16, 2018, 7:05am UTC](https://discuss.elastic.co/t/multi-line-csv-log/124174 "2018-03-16T07:05:01Z")
We have a CSV log and the very last element contains a multi line message. Only the first line appears in Elastic. input { beats { port =\> 5044 } stdin { codec =\> multiline { pattern =\> "\\n" what =\> "previous" } … --- ## [Logstash2.4 "if" subsentence doesnt work](https://discuss.elastic.co/t/logstash2-4-if-subsentence-doesnt-work/124092)
**Author:** [@zxq209](https://discuss.elastic.co/u/zxq209)\ **Replies:** 4\ **Last updated:** [March 16, 2018, 6:57am UTC](https://discuss.elastic.co/t/logstash2-4-if-subsentence-doesnt-work/124092 "2018-03-16T06:57:31Z")
I'm using logstash-2.4.1 and elasticsearch-2.4.6. Depending following config,logstash can write the log data into EL and build the index input { file { type =\> "toll" path =\> \["/path/to/file4/\*.lo… --- ## [Logstash-input-cloudwatch plugin data is not sending to es index](https://discuss.elastic.co/t/logstash-input-cloudwatch-plugin-data-is-not-sending-to-es-index/124093)
**Author:** [@Sai\_Yarravarapu](https://discuss.elastic.co/u/Sai_Yarravarapu)\ **Replies:** 0\ **Last updated:** [March 15, 2018, 11:59am UTC](https://discuss.elastic.co/t/logstash-input-cloudwatch-plugin-data-is-not-sending-to-es-index/124093 "2018-03-15T11:59:40Z")
index not created.... input { cloudwatch { access\_key\_id =\> "\*\*\*\*\*" secret\_access\_key =\> "\*\*\*\*\*\*\*" namespace =\> "AWS/S3" metrics =\> \["BucketSizeBytes","NumberOfObjects"\] filters =\> { "BucketName" =\> "awsbilling" } … --- ## [Migration issues from Logstash 2.4 to 5.6](https://discuss.elastic.co/t/migration-issues-from-logstash-2-4-to-5-6/119888)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 5\ **Last updated:** [March 16, 2018, 4:36am UTC](https://discuss.elastic.co/t/migration-issues-from-logstash-2-4-to-5-6/119888 "2018-03-16T04:36:53Z")
Hello there, I am trying to migrate from 2.4 to 5.6 on CentOS 6.9 and I have a slight issue. When I try to start logstash via /etc/init.d/logstash.rpmsave start logstash I get an error in logstash.err stating WARNING… --- ## [What is the new Syntax for Event api in 6.0.0 for following example?](https://discuss.elastic.co/t/what-is-the-new-syntax-for-event-api-in-6-0-0-for-following-example/124032)
**Author:** [@naveen\_K.N](https://discuss.elastic.co/u/naveen_K.N)\ **Replies:** 2\ **Last updated:** [March 16, 2018, 4:25am UTC](https://discuss.elastic.co/t/what-is-the-new-syntax-for-event-api-in-6-0-0-for-following-example/124032 "2018-03-16T04:25:52Z")
Hi ELK team , event\['app'\]=event\['wmcode'\]\[1..event\['wmcode'\].length-2\] any reference on this will be great help Thanks, Naveen --- ## [Create standard timestamp](https://discuss.elastic.co/t/create-standard-timestamp/124071)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 4\ **Last updated:** [March 16, 2018, 2:50am UTC](https://discuss.elastic.co/t/create-standard-timestamp/124071 "2018-03-16T02:50:54Z")
In my logstash, I used KV filter to parse the log and now I have 2 fields for date and time. "date" =\> "2017-10-10", "time" =\> "12:18:23", But I need to build standard timestamp from those date and time fields as below… --- ## [The logstash can support cluster?](https://discuss.elastic.co/t/the-logstash-can-support-cluster/124183)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 6\ **Last updated:** [March 16, 2018, 12:42am UTC](https://discuss.elastic.co/t/the-logstash-can-support-cluster/124183 "2018-03-16T00:42:38Z")
the logstash can support cluster? i have two instances in two machine. the data is use in udp port . can the two instances is a cluster not alone instance. thanks @Christian\_Dahlqvist --- ## [Range filter plugin not recognized in the pipeline file](https://discuss.elastic.co/t/range-filter-plugin-not-recognized-in-the-pipeline-file/124171)
**Author:** [@jason\_smith](https://discuss.elastic.co/u/jason_smith)\ **Replies:** 5\ **Last updated:** [March 15, 2018, 9:19pm UTC](https://discuss.elastic.co/t/range-filter-plugin-not-recognized-in-the-pipeline-file/124171 "2018-03-15T21:19:03Z")
Hello folks, Trying to come up to speed on ELK stack. So far it is interesting and fun. I am using ELK 6.0 on windows 8 OS. I used range filter and logstash throw the following error. Do I need to install range plugin… --- ## [Reg: Issues Monitoring logstash - XPack](https://discuss.elastic.co/t/reg-issues-monitoring-logstash-xpack/121309)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 2\ **Last updated:** [March 15, 2018, 8:12pm UTC](https://discuss.elastic.co/t/reg-issues-monitoring-logstash-xpack/121309 "2018-03-15T20:12:44Z")
Trying to alert when Logstash fails on any pipeline or sends data to dead letter queue. Queries: How to find a Pipeline is not running from XPack/monitoring when it is not logging any detail if pipeline is wrongly con… --- ## [Filter Active Directory logs](https://discuss.elastic.co/t/filter-active-directory-logs/124145)
**Author:** [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Replies:** 2\ **Last updated:** [March 15, 2018, 7:43pm UTC](https://discuss.elastic.co/t/filter-active-directory-logs/124145 "2018-03-15T19:43:39Z")
Hello, I would like to send only active directory logs with specific Id from logstash to Elasticsearch. Please! What config do I need to do at logstash configuration file to achieve this? example of event\_Id:"4625"==… --- ## [Load custom grok patterns at startup](https://discuss.elastic.co/t/load-custom-grok-patterns-at-startup/124121)
**Author:** [@pfseth](https://discuss.elastic.co/u/pfseth)\ **Replies:** 1\ **Last updated:** [March 15, 2018, 7:31pm UTC](https://discuss.elastic.co/t/load-custom-grok-patterns-at-startup/124121 "2018-03-15T19:31:18Z")
Is it possible to load custom grok patterns at the startup of logstash ? i would like to avoid loading grok filters each time filter { grok { patterns\_dir =\> "/etc/logstash/grok/" match =\> { "message" =\> "%{CALL}" … --- ## [How can I have multiple concurrent jdbc\_streaming filter instances?](https://discuss.elastic.co/t/how-can-i-have-multiple-concurrent-jdbc-streaming-filter-instances/124150)
**Author:** [@jdmcalee](https://discuss.elastic.co/u/jdmcalee)\ **Replies:** 4\ **Last updated:** [March 15, 2018, 7:30pm UTC](https://discuss.elastic.co/t/how-can-i-have-multiple-concurrent-jdbc-streaming-filter-instances/124150 "2018-03-15T19:30:05Z")
I have a config using the jdbc input plugin, plus 3 instances of jdbc\_streaming filters to gather data I need to create an event. It all works, in terms of getting the events into elasticsearch as I want them to be. Howe… --- ## [Reading encrypted Avro records, do I need a new codec?](https://discuss.elastic.co/t/reading-encrypted-avro-records-do-i-need-a-new-codec/123291)
**Author:** [@JacksonBailey](https://discuss.elastic.co/u/JacksonBailey)\ **Replies:** 3\ **Last updated:** [March 15, 2018, 5:09pm UTC](https://discuss.elastic.co/t/reading-encrypted-avro-records-do-i-need-a-new-codec/123291 "2018-03-15T17:09:28Z")
Previously we have read from Kafka topics containing Avro records using the avro codec and Avro records using Confluent Schema Registry using the avro\_schema\_registry codec. Now, we have encrypted Kafka messages. Our en… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=799) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=801)