# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=809 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 810 --- ## [Dead Letter Queue can't be enabled](https://discuss.elastic.co/t/dead-letter-queue-cant-be-enabled/121447)
**Author:** [@manya12](https://discuss.elastic.co/u/manya12)\ **Replies:** 2\ **Last updated:** [March 5, 2018, 12:12pm UTC](https://discuss.elastic.co/t/dead-letter-queue-cant-be-enabled/121447 "2018-03-05T12:12:34Z")
Hi Team, I am trying to use dead letter queue feature and want to create a new index for dlq input events. Here are my configurations: in logstash.yml: path.data: /usr/share/logstash/data dead\_letter\_queue.enable: t… --- ## [Logstash start error](https://discuss.elastic.co/t/logstash-start-error/122485)
**Author:** [@abc965432](https://discuss.elastic.co/u/abc965432)\ **Replies:** 1\ **Last updated:** [March 5, 2018, 11:41am UTC](https://discuss.elastic.co/t/logstash-start-error/122485 "2018-03-05T11:41:46Z")
\[es@localhost logstash-6.2.2\]$ ./bin/logstash -e 'input { stdin { } } output { elasticsearch { host =\> localhost } }' Sending Logstash's logs to /home/soft/logstash/logstash-6.2.2/logs which is now configured via log4j2… --- ## [Java heap space error - 99% after increase](https://discuss.elastic.co/t/java-heap-space-error-99-after-increase/122493)
**Author:** [@stevesimpson](https://discuss.elastic.co/u/stevesimpson)\ **Replies:** 0\ **Last updated:** [March 5, 2018, 11:35am UTC](https://discuss.elastic.co/t/java-heap-space-error-99-after-increase/122493 "2018-03-05T11:35:40Z")
Hi, Over the weekend I saw a number of java.lang.OutOfMemoryError: Java heap space errors in the logstash logs. After reading the docs I've tuned the default settings up to 16G (32GB Server) however I'm are still seeing… --- ## [Stop grok from adding backslash automatically to escape \\](https://discuss.elastic.co/t/stop-grok-from-adding-backslash-automatically-to-escape/121643)
**Author:** [@Vamsi\_Rao](https://discuss.elastic.co/u/Vamsi_Rao)\ **Replies:** 8\ **Last updated:** [March 5, 2018, 11:31am UTC](https://discuss.elastic.co/t/stop-grok-from-adding-backslash-automatically-to-escape/121643 "2018-03-05T11:31:35Z")
I have the following log: 2018-02-27 04:54 +00:00: {"name":"sails","hostname":"ip-111-11-11-111","pid":256213,"level":30,"res":{"statusCode":200,"header":"HTTP/1.1 200 OK\\r\\nX-Powered-By: Sails \\\r\\nContent-… --- ## [Unsupported platform: x86\_64-linux](https://discuss.elastic.co/t/unsupported-platform-x86-64-linux/121234)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 3\ **Last updated:** [March 5, 2018, 9:36am UTC](https://discuss.elastic.co/t/unsupported-platform-x86-64-linux/121234 "2018-03-05T09:36:20Z")
Hello, I followed the guide https://www.elastic.co/guide/en/logstash/6.2/installing-logstash.html I used "yum" because I have a CentOs 6.9. I configured and started logstash but nothing is coming. I checked out the logs… --- ## [Logstash on docker](https://discuss.elastic.co/t/logstash-on-docker/121793)
**Author:** [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Replies:** 12\ **Last updated:** [March 5, 2018, 9:28am UTC](https://discuss.elastic.co/t/logstash-on-docker/121793 "2018-03-05T09:28:39Z")
Please help me out with this error I am not able to understand where I am going wrong \[gagarwal3@gaurav13\]~/tmp% docker run -h logstash --name logstash --link elasticsearch:elasticsearch -it --rm -v "$PWD":/config-dir l… --- ## [How to update field to "keyword" using Logstash](https://discuss.elastic.co/t/how-to-update-field-to-keyword-using-logstash/122466)
**Author:** [@emma](https://discuss.elastic.co/u/emma)\ **Replies:** 0\ **Last updated:** [March 5, 2018, 9:16am UTC](https://discuss.elastic.co/t/how-to-update-field-to-keyword-using-logstash/122466 "2018-03-05T09:16:17Z")
I am new to ElasticSearch and Logstash i have a DB with tables, I exported them to CSVs then imported to ElasticSearch using Logstash sample: { input { file { path =\> "C:\\logstash-6.2.2\\bin\\profile.csv" start\_posi… --- ## [Matching string field and changing it to date](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 3\ **Last updated:** [March 5, 2018, 8:35am UTC](https://discuss.elastic.co/t/matching-string-field-and-changing-it-to-date/122407 "2018-03-05T08:35:59Z")
Hi everyone! I have the following JSON doc: { "DataChangeInfo" : "Archive Log Set archiveLogSet.25933761.25933688", "documentsList" : \[ { "commandScn": "25933758", "commandCommitScn": "0", "commandSequence": "3",… --- ## [Logstash output plugin syslog enquiry](https://discuss.elastic.co/t/logstash-output-plugin-syslog-enquiry/122452)
**Author:** [@peterch](https://discuss.elastic.co/u/peterch)\ **Replies:** 0\ **Last updated:** [March 5, 2018, 7:59am UTC](https://discuss.elastic.co/t/logstash-output-plugin-syslog-enquiry/122452 "2018-03-05T07:59:21Z")
Dear all, I am trying to using plugin syslog to forward the log to other place instead of elasticsearch. But I find the log as follow Mar 5 15:39:55 192.168.1.1 Mar 05 07:39:53 192.168.1.2 \[-\]: connect from localhost T… --- ## [Log4j input migration to Beats](https://discuss.elastic.co/t/log4j-input-migration-to-beats/122402)
**Author:** [@plexaikm](https://discuss.elastic.co/u/plexaikm)\ **Replies:** 2\ **Last updated:** [March 5, 2018, 7:31am UTC](https://discuss.elastic.co/t/log4j-input-migration-to-beats/122402 "2018-03-05T07:31:47Z")
Hello As stated in the documentation log4j input plugin for logstash is deprecated (security reasons) and log4j2 input plugin (community) is quite not maintained... The official recommendation for migration is to use f… --- ## [Dynamic name how to change the type](https://discuss.elastic.co/t/dynamic-name-how-to-change-the-type/122448)
**Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Replies:** 0\ **Last updated:** [March 5, 2018, 7:16am UTC](https://discuss.elastic.co/t/dynamic-name-how-to-change-the-type/122448 "2018-03-05T07:16:03Z")
Version:6.1.3 Operating System:win filter { grok{ match =\> \[ "message","\[(?\[^:\]\]):(?\[^\]\])\]" \] } mutate { #convert =\> \["value1", "float"\] add\_field =\> { "%{key1}" =\> '%{value1}' } convert =\> \["%{key}", "f… --- ## [Logstash 5.6.4: Fluent parse error, original data now in message field: undefined method merge for nil:NilClass](https://discuss.elastic.co/t/logstash-5-6-4-fluent-parse-error-original-data-now-in-message-field-undefined-method-merge-for-nil-nilclass/122442)
**Author:** [@patsevanton](https://discuss.elastic.co/u/patsevanton)\ **Replies:** 0\ **Last updated:** [March 5, 2018, 6:33am UTC](https://discuss.elastic.co/t/logstash-5-6-4-fluent-parse-error-original-data-now-in-message-field-undefined-method-merge-for-nil-nilclass/122442 "2018-03-05T06:33:13Z")
Hello everyone! When updating td-agent from 2.3.4 to 2.3.6 logs in elasticsearch ceased to arrive. Logstash swears at \[2018-02-24T19:28:04,478\]\[ERROR\]\[logstash.codecs.fluent \] Fluent parse error, original data now in… --- ## [Date format issue in logsatsh filter](https://discuss.elastic.co/t/date-format-issue-in-logsatsh-filter/122420)
**Author:** [@rajeshb44](https://discuss.elastic.co/u/rajeshb44)\ **Replies:** 2\ **Last updated:** [March 5, 2018, 3:46am UTC](https://discuss.elastic.co/t/date-format-issue-in-logsatsh-filter/122420 "2018-03-05T03:46:47Z")
yyyy-MM-dd HH:mm:ss.sss time format issue in logsatsh filter --- ## [Logstash server not starting on system reboot](https://discuss.elastic.co/t/logstash-server-not-starting-on-system-reboot/122008)
**Author:** [@dennis.1157](https://discuss.elastic.co/u/dennis.1157)\ **Replies:** 3\ **Last updated:** [March 2, 2018, 6:57am UTC](https://discuss.elastic.co/t/logstash-server-not-starting-on-system-reboot/122008 "2018-03-02T06:57:16Z")
I have the ELK stack installed on Ubuntu 14.04. Everything works when I run Logstash from the command line but as a service, the server does not seem to be able to start by itself. Here's the log from /var/log/logstash/… --- ## [6.2.2 Debug Message](https://discuss.elastic.co/t/6-2-2-debug-message/122382)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 8:31pm UTC](https://discuss.elastic.co/t/6-2-2-debug-message/122382 "2018-03-04T20:31:30Z")
I have been getting this message in the logstash logs. Kinda looks like an event stuck in the pipeline but I'm not really sure. I don't have any files in the directory that it is monitoring for file ingest. It appears… --- ## [Kubernetes: Logstash consumer does not reconnect to rabbitmq when rabbitmq pod restarts](https://discuss.elastic.co/t/kubernetes-logstash-consumer-does-not-reconnect-to-rabbitmq-when-rabbitmq-pod-restarts/122348)
**Author:** [@Todd\_Lyons](https://discuss.elastic.co/u/Todd_Lyons)\ **Replies:** 2\ **Last updated:** [March 4, 2018, 8:21pm UTC](https://discuss.elastic.co/t/kubernetes-logstash-consumer-does-not-reconnect-to-rabbitmq-when-rabbitmq-pod-restarts/122348 "2018-03-04T20:21:08Z")
Hi, we have an ELK stack running in a Kubernetes cluster (ELK ES nodes are EC2, but everything else is pods). The other Kube clusters send traffic to this ELK stack over TLS. This is done by a logstash-relay pod runnin… --- ## [Can i construct an array of hashes from array of strings](https://discuss.elastic.co/t/can-i-construct-an-array-of-hashes-from-array-of-strings/122383)
**Author:** [@david\_reynolds](https://discuss.elastic.co/u/david_reynolds)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 8:19pm UTC](https://discuss.elastic.co/t/can-i-construct-an-array-of-hashes-from-array-of-strings/122383 "2018-03-04T20:19:21Z")
Using Logstash 5.6. Given a single event (a string) that contains a number of lines like (a) I need to create an array of hashes to produce the output (b) so far I can produce an array of strings using the mutate filt… --- ## [Logstash iptables log parse](https://discuss.elastic.co/t/logstash-iptables-log-parse/122389)
**Author:** [@jerryhwang72](https://discuss.elastic.co/u/jerryhwang72)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 7:03pm UTC](https://discuss.elastic.co/t/logstash-iptables-log-parse/122389 "2018-03-04T19:03:32Z")
Hi, ELK run in containers. I setup iptables send all input/forward/output logs to logstash. example log seen on kibana discover pane. @version:1 host:3.3.3.3 @timestamp:March 3rd 2018, 12:14:45.220 message:\<4\>Mar 3 20… --- ## [How to combine Web Proxy logs into one message](https://discuss.elastic.co/t/how-to-combine-web-proxy-logs-into-one-message/120484)
**Author:** [@khabme](https://discuss.elastic.co/u/khabme)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 5:17pm UTC](https://discuss.elastic.co/t/how-to-combine-web-proxy-logs-into-one-message/120484 "2018-03-04T17:17:00Z")
Please excuse me for my English. We successfully doing many things through logstash. (parse with csv filter around 25 fields, decode URL more amazing things). But thousands referer web request can't allow to analyze lo… --- ## [Logstash forwarder viable?](https://discuss.elastic.co/t/logstash-forwarder-viable/122406)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 3\ **Last updated:** [March 4, 2018, 3:18pm UTC](https://discuss.elastic.co/t/logstash-forwarder-viable/122406 "2018-03-04T15:18:21Z")
I have a scenario where I need to push logs from edge nodes to central ES. I have to process multiline log messages and the logs messages need to use dissect/grok plugin behaviour to extract parts of it into fields like … --- ## [Mapping for keyword "thread(s)"](https://discuss.elastic.co/t/mapping-for-keyword-thread-s/122175)
**Author:** [@Criviere](https://discuss.elastic.co/u/Criviere)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 12:19am UTC](https://discuss.elastic.co/t/mapping-for-keyword-thread-s/122175 "2018-03-04T00:19:06Z")
How can I about go about creating a map for the keyword "thread(s)"? --- ## [Grok filter in LOGSTASH](https://discuss.elastic.co/t/grok-filter-in-logstash/122245)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 9\ **Last updated:** [March 3, 2018, 4:55pm UTC](https://discuss.elastic.co/t/grok-filter-in-logstash/122245 "2018-03-03T16:55:15Z")
Hi, I have trouble with parsing a Tomcat LOG like : 2018-03-02 11:39:06,309| INFO|http-40074-7|com.capgemini.mvne.var.manager.simplicime.ecare.CoordonneesClientManager|Construction des données envoyées en sortie du WS:… --- ## [Logstash: input codec: line -- what is the longest length accepted?](https://discuss.elastic.co/t/logstash-input-codec-line-what-is-the-longest-length-accepted/122346)
**Author:** [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\ **Replies:** 1\ **Last updated:** [March 3, 2018, 12:34pm UTC](https://discuss.elastic.co/t/logstash-input-codec-line-what-is-the-longest-length-accepted/122346 "2018-03-03T12:34:04Z")
We are on logstash 6.2.2 on CentOS 7 We use a custom input spec, type: tcp, codec: line We are seeing parse errors in the logstash logs. We wonder: When we send line formatted input, perhaps a super long line is getti… --- ## [How to parse more similar fields with Logstash?](https://discuss.elastic.co/t/how-to-parse-more-similar-fields-with-logstash/122347)
**Author:** [@Francesca\_P](https://discuss.elastic.co/u/Francesca_P)\ **Replies:** 1\ **Last updated:** [March 3, 2018, 12:25pm UTC](https://discuss.elastic.co/t/how-to-parse-more-similar-fields-with-logstash/122347 "2018-03-03T12:25:46Z")
Hi, I'm new with Logstash. I'm trying to parse a log file that contain the following fields: 2017-02-02 07:19:16,908 \[varMes: \