# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=812 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 813 --- ## [How to load data in elk by go language?](https://discuss.elastic.co/t/how-to-load-data-in-elk-by-go-language/121605)
**Author:** [@yuluopiaoyang](https://discuss.elastic.co/u/yuluopiaoyang)\ **Replies:** 3\ **Last updated:** [February 28, 2018, 2:57am UTC](https://discuss.elastic.co/t/how-to-load-data-in-elk-by-go-language/121605 "2018-02-28T02:57:52Z")
How to load data in elk by go language?Any example? Thank you! --- ## [Simple ruby filter failing](https://discuss.elastic.co/t/simple-ruby-filter-failing/121711)
**Author:** [@awynham](https://discuss.elastic.co/u/awynham)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 10:36pm UTC](https://discuss.elastic.co/t/simple-ruby-filter-failing/121711 "2018-02-27T22:36:59Z")
I kept running into a wall trying to get a ruby file to work for a filter and I finally simplified my config file to simply this: filter { ruby { code =\> "event.cancel" } } But even with this simple exa… --- ## ["error registering plugin" on logstash](https://discuss.elastic.co/t/error-registering-plugin-on-logstash/121744)
**Author:** [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\ **Replies:** 0\ **Last updated:** [February 27, 2018, 10:24pm UTC](https://discuss.elastic.co/t/error-registering-plugin-on-logstash/121744 "2018-02-27T22:24:28Z")
I am chasing a stability problem in logstash and have turned on debug logging in the log4j config found in /etc/logstash/ Running logstash 5.6 We use only a custom tcp listener. issues spotted: \[2018-02-27T16:19:21,3… --- ## [Configuring Multiple Pipelines](https://discuss.elastic.co/t/configuring-multiple-pipelines/118299)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 8:22pm UTC](https://discuss.elastic.co/t/configuring-multiple-pipelines/118299 "2018-02-27T20:22:21Z")
Logstash 6.1.1 on Server 2012 R2 Trying to configure multiple pipelines but coming up short. In pipelines.yml: - pipeline.id: Beats\_Pipe path.config: "c:/Logstash/config/beats.yml" Here's my beats.yml pipeline: i… --- ## [Grok syslog-ng stats](https://discuss.elastic.co/t/grok-syslog-ng-stats/121685)
**Author:** [@pdna](https://discuss.elastic.co/u/pdna)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 7:18pm UTC](https://discuss.elastic.co/t/grok-syslog-ng-stats/121685 "2018-02-27T19:18:19Z")
Feb 20 00:30:00 host syslog-ng\[12336\]: Log statistics; queued='global(scratch\_buffers\_count)=0', processed='destination(ntpd\_clients)=59', processed='destination(allusers)=0', processed='center(received)=372450', proces… --- ## [Logstash and WMI Plug-in Help](https://discuss.elastic.co/t/logstash-and-wmi-plug-in-help/121708)
**Author:** [@rickyrome86](https://discuss.elastic.co/u/rickyrome86)\ **Replies:** 0\ **Last updated:** [February 27, 2018, 5:32pm UTC](https://discuss.elastic.co/t/logstash-and-wmi-plug-in-help/121708 "2018-02-27T17:32:22Z")
we have Wazuh installed in our development lab. We have a few critical type systems that will not/cannot have the agent installed and that we will need the windows event logs pulled from into logstash, from some brief re… --- ## [Using mapping template from {:path=\>nil}](https://discuss.elastic.co/t/using-mapping-template-from-path-nil/121694)
**Author:** [@vaishali1](https://discuss.elastic.co/u/vaishali1)\ **Replies:** 7\ **Last updated:** [February 27, 2018, 5:29pm UTC](https://discuss.elastic.co/t/using-mapping-template-from-path-nil/121694 "2018-02-27T17:29:36Z")
Hi, I am facing some issue in importing a data through Logstash input { file { path =\>"C:\\Users\\328347935\\Downloads\\EKL\\logstash-6.2.2\\mocklog.log" start\_position =\> "beginning" codec =\> "plain" } } filter { … --- ## [Converting a numeric IPv4 address to dotted format string](https://discuss.elastic.co/t/converting-a-numeric-ipv4-address-to-dotted-format-string/121193)
**Author:** [@jtkkex](https://discuss.elastic.co/u/jtkkex)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 5:25pm UTC](https://discuss.elastic.co/t/converting-a-numeric-ipv4-address-to-dotted-format-string/121193 "2018-02-27T17:25:49Z")
hi, I have tried using Ruby filter to convert a decimal IP address to the dotted format. For some reason, it just fails. I have tried many ways, found with google, but not succeeded. The filter just throws a rubyexce… --- ## [Logstash plugin install fails](https://discuss.elastic.co/t/logstash-plugin-install-fails/121700)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 0\ **Last updated:** [February 27, 2018, 5:13pm UTC](https://discuss.elastic.co/t/logstash-plugin-install-fails/121700 "2018-02-27T17:13:55Z")
I'm trying to install a plugins for logstash 6.1.1. We have configured our f/w to NOT decrypt this traffic as it seems to break the plugin installs. I installed logstash-filter-tld and logstash-filter-rest just fine. … --- ## [Configuring message\_key kafka output plugin](https://discuss.elastic.co/t/configuring-message-key-kafka-output-plugin/121421)
**Author:** [@Maher\_Ben\_Taleb\_Ali](https://discuss.elastic.co/u/Maher_Ben_Taleb_Ali)\ **Replies:** 2\ **Last updated:** [February 27, 2018, 4:44pm UTC](https://discuss.elastic.co/t/configuring-message-key-kafka-output-plugin/121421 "2018-02-27T16:44:36Z")
Hi, I am trying to send data from elasticsearch into Kafka. input { elasticsearch { hosts =\> "localhost" index =\> "articles" } } output { kafka { topic\_id =\> "articles"… --- ## [How to run logstash config file on Amazon ec2 instance](https://discuss.elastic.co/t/how-to-run-logstash-config-file-on-amazon-ec2-instance/121418)
**Author:** [@alfastep](https://discuss.elastic.co/u/alfastep)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 3:11pm UTC](https://discuss.elastic.co/t/how-to-run-logstash-config-file-on-amazon-ec2-instance/121418 "2018-02-27T15:11:37Z")
I have used systemctl start logstash to get logstash up and running. I was wondering how I can run a logstash config file to ingest data into elastisearch on the ec2 instance? --- ## [Can any veterans give me the best way to accomplish this mail server filter?](https://discuss.elastic.co/t/can-any-veterans-give-me-the-best-way-to-accomplish-this-mail-server-filter/121681)
**Author:** [@jaron](https://discuss.elastic.co/u/jaron)\ **Replies:** 0\ **Last updated:** [February 27, 2018, 3:00pm UTC](https://discuss.elastic.co/t/can-any-veterans-give-me-the-best-way-to-accomplish-this-mail-server-filter/121681 "2018-02-27T15:00:08Z")
I'm pulling logs from a mail server called hmailserver into logstash and parsing them out with some of my own grok. I'm a complete noob at aggregating and despite reading every document on this site multiple times, I'm … --- ## [Why doesn’t logstash run as a deamon?](https://discuss.elastic.co/t/why-doesn-t-logstash-run-as-a-deamon/121490)
**Author:** [@PerPer](https://discuss.elastic.co/u/PerPer)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 7:33am UTC](https://discuss.elastic.co/t/why-doesn-t-logstash-run-as-a-deamon/121490 "2018-02-27T07:33:56Z")
Hi Why doesn’t logstash run as a deamon? I am trying to run logstash on Xubuntu in VM in VMware Workstation. I can start logstash in command prompt and make it use a simple configuration.conf as expected. One that tak… --- ## [What will be the best way to create ES index for mulit-join tables from Mysql database](https://discuss.elastic.co/t/what-will-be-the-best-way-to-create-es-index-for-mulit-join-tables-from-mysql-database/117558)
**Author:** [@viphuangwei](https://discuss.elastic.co/u/viphuangwei)\ **Replies:** 3\ **Last updated:** [January 30, 2018, 2:43pm UTC](https://discuss.elastic.co/t/what-will-be-the-best-way-to-create-es-index-for-mulit-join-tables-from-mysql-database/117558 "2018-01-30T14:43:08Z")
We need 11 tables to join together to generate the search result in MySQL database. We use Elasticsearch as our full-text search engine. There is no join operation in ES. solution write join query in logstash to crea… --- ## [Make logstash filter map field differantly based on the value](https://discuss.elastic.co/t/make-logstash-filter-map-field-differantly-based-on-the-value/121675)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 2:33pm UTC](https://discuss.elastic.co/t/make-logstash-filter-map-field-differantly-based-on-the-value/121675 "2018-02-27T14:33:52Z")
Hi everyone! I'm using the ELK 6 stack, and I have tranactions JSON structure like so: \[ { "fieldId": "PK\_NEWJOURNAL", "fieldType": "NUMBER", "fieldValue": "1235543", "fieldChanged": "Y" }, { "fieldId": "OFFI… --- ## [Problems With configure Multi Pipelines Logtash V6.1.2](https://discuss.elastic.co/t/problems-with-configure-multi-pipelines-logtash-v6-1-2/121146)
**Author:** [@agonex](https://discuss.elastic.co/u/agonex)\ **Replies:** 8\ **Last updated:** [February 27, 2018, 2:28pm UTC](https://discuss.elastic.co/t/problems-with-configure-multi-pipelines-logtash-v6-1-2/121146 "2018-02-27T14:28:28Z")
Hi, I trying configure logstash with multipipelines and cannot makes works, i follow the documentations and is doesnt work... I comment the path.config in the logstash.yml and add the path's of the each pipeline in pipel… --- ## [Http-poller input-plugin "Connection timed out: connect"](https://discuss.elastic.co/t/http-poller-input-plugin-connection-timed-out-connect/121024)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 6\ **Last updated:** [February 27, 2018, 1:32pm UTC](https://discuss.elastic.co/t/http-poller-input-plugin-connection-timed-out-connect/121024 "2018-02-27T13:32:26Z")
Hi, When i am hitting URL from my local machine it is giving 200 response but same http\_poller input when i tried to run from server, I am getting "Connection timed out: connect" error. Please help me to solve this issu… --- ## [Logstash don't reconnect after the fluctuation with Influxdb](https://discuss.elastic.co/t/logstash-dont-reconnect-after-the-fluctuation-with-influxdb/121658)
**Author:** [@ashurawat](https://discuss.elastic.co/u/ashurawat)\ **Replies:** 0\ **Last updated:** [February 27, 2018, 12:59pm UTC](https://discuss.elastic.co/t/logstash-dont-reconnect-after-the-fluctuation-with-influxdb/121658 "2018-02-27T12:59:21Z")
Hi All, I am running few Logstash instances to pick the data from REDIS and put the data in Influxdb. But sometimes we face connectivity fluctuation between logstash and influxdb. And it occurs for few seconds only. But… --- ## [Regex for json format](https://discuss.elastic.co/t/regex-for-json-format/121635)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 12:03pm UTC](https://discuss.elastic.co/t/regex-for-json-format/121635 "2018-02-27T12:03:21Z")
Hello I am using the logstash to seprate the json format can someone suggest me the regex. as i want to seprate all the names after "have" and it may contain as many names and with a common format i want to extract a… --- ## [Elastic search logstash](https://discuss.elastic.co/t/elastic-search-logstash/120568)
**Author:** [@Ajit\_Kumar1](https://discuss.elastic.co/u/Ajit_Kumar1)\ **Replies:** 34\ **Last updated:** [February 27, 2018, 10:27am UTC](https://discuss.elastic.co/t/elastic-search-logstash/120568 "2018-02-27T10:27:36Z")
Hi all, I want to use logstash for real time syncing of data in both mongodb and elasticsearch. i am using mongoosastic for real time syncing and it is working fine but i am not able to trnasfer the existing mongodb d… --- ## [How to create new field into an elasticsearch index using logstash and python](https://discuss.elastic.co/t/how-to-create-new-field-into-an-elasticsearch-index-using-logstash-and-python/121546)
**Author:** [@soukaina](https://discuss.elastic.co/u/soukaina)\ **Replies:** 7\ **Last updated:** [February 27, 2018, 10:36am UTC](https://discuss.elastic.co/t/how-to-create-new-field-into-an-elasticsearch-index-using-logstash-and-python/121546 "2018-02-27T10:36:36Z")
Hi, im trying to generate tweets sentiments with a python script, and want to create a new field into elasticsearch, that contains the sentiment (ss\["compound"\] value) for each tweet. Any idea??? Thank you \[t1\] --- ## [Google pubsub input keeps sending 'Error 400: You have not specified an ack ID in the request.'](https://discuss.elastic.co/t/google-pubsub-input-keeps-sending-error-400-you-have-not-specified-an-ack-id-in-the-request/121052)
**Author:** [@michaelcheung](https://discuss.elastic.co/u/michaelcheung)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 10:13am UTC](https://discuss.elastic.co/t/google-pubsub-input-keeps-sending-error-400-you-have-not-specified-an-ack-id-in-the-request/121052 "2018-02-27T10:13:02Z")
Hi, This is my Dockerfile. FROM docker.elastic.co/logstash/logstash:6.2.2 ENV SSL\_CERT\_FILE /opt/logstash/logstash-core/lib/logstash/certs/cacert.pem RUN logstash-plugin install logstash-input-google\_pubsub This is my… --- ## [Merge problem](https://discuss.elastic.co/t/merge-problem/121615)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 0\ **Last updated:** [February 27, 2018, 9:16am UTC](https://discuss.elastic.co/t/merge-problem/121615 "2018-02-27T09:16:55Z")
I can't wrap my head around how to accomplish this, but postfix logs two separate events for one email. The first event contains the from address: Feb 27 11:30:10 mail postfix/qmgr\[8620\]: 24C4C681F19: from=jhon@gmail.co… --- ## [Default Logstash 6 mapping template is deprecated](https://discuss.elastic.co/t/default-logstash-6-mapping-template-is-deprecated/121613)
**Author:** [@T3rm11](https://discuss.elastic.co/u/T3rm11)\ **Replies:** 0\ **Last updated:** [February 27, 2018, 9:07am UTC](https://discuss.elastic.co/t/default-logstash-6-mapping-template-is-deprecated/121613 "2018-02-27T09:07:52Z")
I just upgraded to ELK 6 and updated my Logstash mapping template to the default one shipped with Logstash 6. When I use this the Elasticsearch deprecation log show me this warning: \[2018-02-27T09:40:46,871\]\[WARN \]\[o.… --- ## [Importing Geo Point from MySQL LAT LNG ELK 6.22](https://discuss.elastic.co/t/importing-geo-point-from-mysql-lat-lng-elk-6-22/121340)
**Author:** [@ayub.zafar](https://discuss.elastic.co/u/ayub.zafar)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 8:08am UTC](https://discuss.elastic.co/t/importing-geo-point-from-mysql-lat-lng-elk-6-22/121340 "2018-02-27T08:08:36Z")
I am trying to import LAT, LNG columns from MySQL into ES Geo Point type. At the moment, it does import data but in separate fields. I am using following Logstash script: input { jdbc { jdbc\_driver\_library =\> "C:\\… --- ## [Logstash errors](https://discuss.elastic.co/t/logstash-errors/121566)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 7:02am UTC](https://discuss.elastic.co/t/logstash-errors/121566 "2018-02-27T07:02:21Z")
Hello, I have configured some hosts with filebeat and setup logstash to parse the logs. However the whole thing is failing and on the logstash I can see the following errors: \[2018-02-26T20:53:32,226\]\[INFO \]\[logstash.o… --- ## [Systemctl status logstash](https://discuss.elastic.co/t/systemctl-status-logstash/121552)
**Author:** [@alfastep](https://discuss.elastic.co/u/alfastep)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 3:23am UTC](https://discuss.elastic.co/t/systemctl-status-logstash/121552 "2018-02-27T03:23:49Z")
When I run: systemctl start logstash and then I run: systemctl status logstash I get the following message: logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset:… --- ## [Useragent is missing ELB-HealthChecker](https://discuss.elastic.co/t/useragent-is-missing-elb-healthchecker/121143)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 5\ **Last updated:** [February 26, 2018, 11:04pm UTC](https://discuss.elastic.co/t/useragent-is-missing-elb-healthchecker/121143 "2018-02-26T23:04:53Z")
Im using the useragent plugin in my logstash pipeline: useragent { prefix =\> "userAgent\_" source =\> "userAgent" } But its not getting the ELB healthcheck user agent Here is an example log line: 2018-02-22 14:53:31… --- ## [Is it possible to use the json codec along with a json filter to further parse things into other fields?](https://discuss.elastic.co/t/is-it-possible-to-use-the-json-codec-along-with-a-json-filter-to-further-parse-things-into-other-fields/121120)
**Author:** [@Tieis](https://discuss.elastic.co/u/Tieis)\ **Replies:** 8\ **Last updated:** [February 26, 2018, 9:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-the-json-codec-along-with-a-json-filter-to-further-parse-things-into-other-fields/121120 "2018-02-26T21:03:06Z")
I've been looking around and experimented a bit, but haven't gotten it to work or so to say. I have a tcp input with the json codec, along with an elasticsearch output with a template that adds some custom fields. I use… --- ## [Parsing logs from winlogbeats to Arcsight CEF](https://discuss.elastic.co/t/parsing-logs-from-winlogbeats-to-arcsight-cef/121549)
**Author:** [@ecamero2](https://discuss.elastic.co/u/ecamero2)\ **Replies:** 0\ **Last updated:** [February 26, 2018, 6:56pm UTC](https://discuss.elastic.co/t/parsing-logs-from-winlogbeats-to-arcsight-cef/121549 "2018-02-26T18:56:24Z")
Hello, I am looking for a way to parse events from winlogbeats through logstash to various destinations. We will be sending some events into Elasticsearch, some into tenable security center, and some into Arcsight. What… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=811) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=813)