# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=821 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 822 --- ## [Event Emission Behavior](https://discuss.elastic.co/t/event-emission-behavior/119884)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 4\ **Last updated:** [February 15, 2018, 7:43am UTC](https://discuss.elastic.co/t/event-emission-behavior/119884 "2018-02-15T07:43:43Z")
TLDR: It appears Logstash's emission rate is limited in some way other than provided resources. Started having a weird issue yesterday with Logstash performing very poorly. Typical ingest over the past couple weeks has… --- ## [Configuration error](https://discuss.elastic.co/t/configuration-error/119904)
**Author:** [@Sudhakar\_N](https://discuss.elastic.co/u/Sudhakar_N)\ **Replies:** 3\ **Last updated:** [February 15, 2018, 5:04am UTC](https://discuss.elastic.co/t/configuration-error/119904 "2018-02-15T05:04:10Z")
when i run logstash i am getting below error. \[ERROR\] 2018-02-15 09:32:09.497 \[Ruby-0-Thread-1: /home/suryakiran/sudhakar/elk/logstash-6.2.1/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb… --- ## [Why is Logstash not part of Elastic Cloud?](https://discuss.elastic.co/t/why-is-logstash-not-part-of-elastic-cloud/119893)
**Author:** [@lfk](https://discuss.elastic.co/u/lfk)\ **Replies:** 1\ **Last updated:** [February 15, 2018, 12:07am UTC](https://discuss.elastic.co/t/why-is-logstash-not-part-of-elastic-cloud/119893 "2018-02-15T00:07:27Z")
I'm planning to start using ELK for logging and I've opened a trial Elastic Cloud account. However, I've noticed that Logstash is not included. I thought the idea behind using Elastic Cloud was so that we wouldn't need t… --- ## [Suspected memory leak leading to heap OOM in Logstash 5.6.6](https://discuss.elastic.co/t/suspected-memory-leak-leading-to-heap-oom-in-logstash-5-6-6/117807)
**Author:** [@Christopher\_Hodges](https://discuss.elastic.co/u/Christopher_Hodges)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 11:35pm UTC](https://discuss.elastic.co/t/suspected-memory-leak-leading-to-heap-oom-in-logstash-5-6-6/117807 "2018-02-14T23:35:27Z")
We upgraded to Logstash 5.6.6 across our estate and soon saw Logstash memory usage climb until failure with OOM heap errors on all boxes. The heavier the load the quicker the failure. Each server runs a specific config f… --- ## [Debug errors between filebeat and logstash](https://discuss.elastic.co/t/debug-errors-between-filebeat-and-logstash/119885)
**Author:** [@bm1391](https://discuss.elastic.co/u/bm1391)\ **Replies:** 0\ **Last updated:** [February 14, 2018, 10:03pm UTC](https://discuss.elastic.co/t/debug-errors-between-filebeat-and-logstash/119885 "2018-02-14T22:03:58Z")
I have set up mutual auth for the connection between filebeat and logstash. However, I am getting some errors . Here is my logstash config: beats { port =\> 5044 ssl =\> true ssl\_certificate\_authorities =\> … --- ## [Parsing multiline, look for closing character?](https://discuss.elastic.co/t/parsing-multiline-look-for-closing-character/119850)
**Author:** [@cptnclvn](https://discuss.elastic.co/u/cptnclvn)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 9:24pm UTC](https://discuss.elastic.co/t/parsing-multiline-look-for-closing-character/119850 "2018-02-14T21:24:34Z")
I am working on a project to parse vCenter logs and when vCenter passes an Event, it puts the event details on multiple messages(see below). "message":"\<14\>1 2018-02-14T10:01:12.888790-06:00 vcenter01 vpxd 4683 - - Ev… --- ## [Logstash unrecognized service](https://discuss.elastic.co/t/logstash-unrecognized-service/119839)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 9:11pm UTC](https://discuss.elastic.co/t/logstash-unrecognized-service/119839 "2018-02-14T21:11:48Z")
Hello there, I am working on upgrading Elastic from 2.4 to 5.6. Elasticsearch and Kibana seem to be fine, but when I installed LogStash, I can no longer seem to start logstash. When I try 'service logstash status' I ge… --- ## [Converting old Ruby code to work with new ruby format of Logstash](https://discuss.elastic.co/t/converting-old-ruby-code-to-work-with-new-ruby-format-of-logstash/119869)
**Author:** [@magdieldominguez](https://discuss.elastic.co/u/magdieldominguez)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 8:44pm UTC](https://discuss.elastic.co/t/converting-old-ruby-code-to-work-with-new-ruby-format-of-logstash/119869 "2018-02-14T20:44:22Z")
Hi I am trying to convert a date field that I have into milliseconds. I found this old post https://discuss.elastic.co/t/logstash-convert-date-string-to-timestamp-in-millisecond/52845 I am facing the same issue I have … --- ## [Inifinite-loop-encountered-a-retryable-error 400 error from Elasticsearch](https://discuss.elastic.co/t/inifinite-loop-encountered-a-retryable-error-400-error-from-elasticsearch/119290)
**Author:** [@Christopher\_Hodges](https://discuss.elastic.co/u/Christopher_Hodges)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 5:00pm UTC](https://discuss.elastic.co/t/inifinite-loop-encountered-a-retryable-error-400-error-from-elasticsearch/119290 "2018-02-14T17:00:29Z")
Apologies if this is not the way to continue the discussion on a closed topic. But has Logstash 5.6.1 inifinite loop? Encountered a retryable error been resolved? We are seeing the same issue running Logstash 5.6.5. We … --- ## [Multiline work strange](https://discuss.elastic.co/t/multiline-work-strange/118810)
**Author:** [@breezzz](https://discuss.elastic.co/u/breezzz)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 4:51pm UTC](https://discuss.elastic.co/t/multiline-work-strange/118810 "2018-02-14T16:51:37Z")
Good day! I created a theme about udp and multiline. After that I switched to tсp. After watching for a while I found strange things, they end if I disable multiline. config is: input { tcp { port =\> 5200 c… --- ## [Conflict with \_id](https://discuss.elastic.co/t/conflict-with-id/119741)
**Author:** [@Pororo](https://discuss.elastic.co/u/Pororo)\ **Replies:** 2\ **Last updated:** [February 14, 2018, 3:59pm UTC](https://discuss.elastic.co/t/conflict-with-id/119741 "2018-02-14T15:59:45Z")
Hi, here is the item of my json file. //{"jurHash":"112256955","txnId":"vipus0E48BEC71E28C81F","ts":"2018-01-29 00:03:30.085 +0000","result.statusMessage":"Success","durationMillis":2,"requestId":"9999","extUserId":"te… --- ## [Detect last n lines in a log file](https://discuss.elastic.co/t/detect-last-n-lines-in-a-log-file/119834)
**Author:** [@cilzzz](https://discuss.elastic.co/u/cilzzz)\ **Replies:** 0\ **Last updated:** [February 14, 2018, 3:41pm UTC](https://discuss.elastic.co/t/detect-last-n-lines-in-a-log-file/119834 "2018-02-14T15:41:04Z")
how to read only the last n lines in a logfile using logstash to be able to parse it and drop all the others knowing that there are some duplicate lines? --- ## [Querying elastic search DB using the index name - failing](https://discuss.elastic.co/t/querying-elastic-search-db-using-the-index-name-failing/119799)
**Author:** [@ranganath\_nangineni](https://discuss.elastic.co/u/ranganath_nangineni)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 3:22pm UTC](https://discuss.elastic.co/t/querying-elastic-search-db-using-the-index-name-failing/119799 "2018-02-14T15:22:13Z")
Hi I have multiple indexes in my elastic search DB. I am trying to query one of the index among them but the query is failing and it is connecting to a differnt index rather than the one that i mentioned in the query. T… --- ## [If else on xpath value in Logstash](https://discuss.elastic.co/t/if-else-on-xpath-value-in-logstash/119709)
**Author:** [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 3:03pm UTC](https://discuss.elastic.co/t/if-else-on-xpath-value-in-logstash/119709 "2018-02-14T15:03:00Z")
Hi, I am trying to create two new fields based on the value of xpath. For example if the station\_name is "Finch" then create a field name "ny\_station" else store the value in "nonny\_stations". Can anyone help me that b… --- ## [Twitter plugin for historical tweets](https://discuss.elastic.co/t/twitter-plugin-for-historical-tweets/119818)
**Author:** [@soukaina](https://discuss.elastic.co/u/soukaina)\ **Replies:** 0\ **Last updated:** [February 14, 2018, 2:49pm UTC](https://discuss.elastic.co/t/twitter-plugin-for-historical-tweets/119818 "2018-02-14T14:49:42Z")
Hi, how can i get before-now tweets(historical tweets) with twitter plugin? Is that possible or not? Thank you. --- ## [Logstash pipelines keep running without showing data](https://discuss.elastic.co/t/logstash-pipelines-keep-running-without-showing-data/119682)
**Author:** [@soukaina](https://discuss.elastic.co/u/soukaina)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 2:35pm UTC](https://discuss.elastic.co/t/logstash-pipelines-keep-running-without-showing-data/119682 "2018-02-14T14:35:14Z")
Hi, im starting a logstash pipeline, but it doesn't show any results \[error\]. Any help!! --- ## [Error in multiple match in logstash filter](https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800)
**Author:** [@Laxman](https://discuss.elastic.co/u/Laxman)\ **Replies:** 2\ **Last updated:** [February 14, 2018, 2:14pm UTC](https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800 "2018-02-14T14:14:25Z")
I'm parsing an Execution log and trying to assign different types based on which type of log entry a given line is. Facing Error while execution. not sure what is the issue in filter, can anyone help me on this filter { … --- ## [Stdout output with plain codec](https://discuss.elastic.co/t/stdout-output-with-plain-codec/119712)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 1:29pm UTC](https://discuss.elastic.co/t/stdout-output-with-plain-codec/119712 "2018-02-14T13:29:55Z")
I created a stdout output with no codec specified. When I input a line to stdin I get "2018-02-13T22:44:04.309Z t %{message}". That seems wrong. --- ## [Logstash metadata breaks SIEM ingestion \[SOLVED\]](https://discuss.elastic.co/t/logstash-metadata-breaks-siem-ingestion-solved/119235)
**Author:** [@wyldfury](https://discuss.elastic.co/u/wyldfury)\ **Replies:** 0\ **Last updated:** [February 9, 2018, 12:46pm UTC](https://discuss.elastic.co/t/logstash-metadata-breaks-siem-ingestion-solved/119235 "2018-02-09T12:46:40Z")
\[Update\] This is a LogRhythm problem, not a Logstash one. This is the behaviour in LogRhythm when its syslog relay regexes on the data collector do not match the records you're sending in. So it doesn't correctly identi… --- ## [Unable to read windows log file with logstash](https://discuss.elastic.co/t/unable-to-read-windows-log-file-with-logstash/119788)
**Author:** [@kabali12345](https://discuss.elastic.co/u/kabali12345)\ **Replies:** 0\ **Last updated:** [February 14, 2018, 12:08pm UTC](https://discuss.elastic.co/t/unable-to-read-windows-log-file-with-logstash/119788 "2018-02-14T12:08:20Z")
Hi all..... Here i am trying to read IIS log file with logstash here is my conf input { file { path =\> "C:\\inetpub\\logs\\LogFiles\\W3SVC2\\in180214" sincedb\_path =\> "C:\\logstash-6.0.0\\logstash-6.0.0\\config\\ii… --- ## [Netflow: Unsupported field in template](https://discuss.elastic.co/t/netflow-unsupported-field-in-template/119772)
**Author:** [@sarlacpit](https://discuss.elastic.co/u/sarlacpit)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 11:50am UTC](https://discuss.elastic.co/t/netflow-unsupported-field-in-template/119772 "2018-02-14T11:50:12Z")
I am using Elastiflow to template my Netflow data... Well trying! I keep getting the following in my Logstash logs: \[2018-02-14T11:23:26,907\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field in template 261 {:type=\>1… --- ## [Configuration with multiple types](https://discuss.elastic.co/t/configuration-with-multiple-types/119774)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 11:22am UTC](https://discuss.elastic.co/t/configuration-with-multiple-types/119774 "2018-02-14T11:22:23Z")
Hello, I'm questionning myself about the configuration of logstash, if I receive UDP logs to a port but these logs may have differents types, how can I configure the UDP input then? As I can't listen to the same port mo… --- ## [Prepaing config file of logstash](https://discuss.elastic.co/t/prepaing-config-file-of-logstash/119763)
**Author:** [@Nada\_I](https://discuss.elastic.co/u/Nada_I)\ **Replies:** 2\ **Last updated:** [February 14, 2018, 10:53am UTC](https://discuss.elastic.co/t/prepaing-config-file-of-logstash/119763 "2018-02-14T10:53:03Z")
i want to know how can i install the config file of the logstash and what is the extension of it --- ## [Syslog Input Multiline Fail](https://discuss.elastic.co/t/syslog-input-multiline-fail/119253)
**Author:** [@htechno](https://discuss.elastic.co/u/htechno)\ **Replies:** 8\ **Last updated:** [February 14, 2018, 9:08am UTC](https://discuss.elastic.co/t/syslog-input-multiline-fail/119253 "2018-02-14T09:08:29Z")
Hi there, The microtik sends syslog messages of one RADIUS event in several rows |26|0.099429|10.147.99.3|10.147.99.9|Syslog|137|DAEMON.DEBUG: Feb 8 18:35:18 X5\_tihvinskaya3 sending Accounting-Request with id 34 to 18… --- ## [Please tell me how to get message as well as the content of delimiter and AIR name in output as i am getting only message as output](https://discuss.elastic.co/t/please-tell-me-how-to-get-message-as-well-as-the-content-of-delimiter-and-air-name-in-output-as-i-am-getting-only-message-as-output/119178)
**Author:** [@abhi210797](https://discuss.elastic.co/u/abhi210797)\ **Replies:** 17\ **Last updated:** [February 14, 2018, 8:07am UTC](https://discuss.elastic.co/t/please-tell-me-how-to-get-message-as-well-as-the-content-of-delimiter-and-air-name-in-output-as-i-am-getting-only-message-as-output/119178 "2018-02-14T08:07:16Z")
input { file { path =\> "C:\\PROJECT\\ELK\_STACK\\logstash-6.1.2\\bin\\files\\tcp\_1\_logs.log" } } filter { grok { match =\> \[ "message", "(?^ Error in sending batch file )(?.)" \] match =\> \["message", "(? to AIR server: ) … --- ## [Prune plugin](https://discuss.elastic.co/t/prune-plugin/116329)
**Author:** [@dilipchiru](https://discuss.elastic.co/u/dilipchiru)\ **Replies:** 12\ **Last updated:** [February 14, 2018, 8:17am UTC](https://discuss.elastic.co/t/prune-plugin/116329 "2018-02-14T08:17:52Z")
how to install prune plugin i didn't get the procedure please help me i am really stuck --- ## [Logstrash output elasticsearch plugin nginx https error](https://discuss.elastic.co/t/logstrash-output-elasticsearch-plugin-nginx-https-error/119743)
**Author:** [@2154b6326cfa31601e97](https://discuss.elastic.co/u/2154b6326cfa31601e97)\ **Replies:** 0\ **Last updated:** [February 14, 2018, 7:39am UTC](https://discuss.elastic.co/t/logstrash-output-elasticsearch-plugin-nginx-https-error/119743 "2018-02-14T07:39:56Z")
Install info : elastic version 5.5 logstash version 6.2.0 My \[elastic\] repository is: https://es.myserver.com I do not use \[x-pack\]. Instead, use nginx \[proxy\](https://es.myserver.com =\> localhost: 9200) and basic … --- ## [Logstash gives an warning when running through command window](https://discuss.elastic.co/t/logstash-gives-an-warning-when-running-through-command-window/119606)
**Author:** [@SandeepG](https://discuss.elastic.co/u/SandeepG)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 7:31am UTC](https://discuss.elastic.co/t/logstash-gives-an-warning-when-running-through-command-window/119606 "2018-02-14T07:31:47Z")
Hi, I just downloaded logstash and trying to install in windows 7 through command prompt. While testing logstash with command i am getting this warning. C:\\Elastic Search\\logstash-6.2.0\\bin\>logstash -e 'input { stdin {… --- ## [Import json](https://discuss.elastic.co/t/import-json/119690)
**Author:** [@Pororo](https://discuss.elastic.co/u/Pororo)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 7:09am UTC](https://discuss.elastic.co/t/import-json/119690 "2018-02-14T07:09:00Z")
Hi, I was trying to import json file to ES thru logstash but it seems something wrong with my operation. Here is my json sample: {"jurHash":"112256955","txnId":"vipus0E48BEC71E28C81F","ts":"2018-01-29 00:03:30.085 +000… --- ## [Grokparsefailure error is occurring](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295)
**Author:** [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)\ **Replies:** 9\ **Last updated:** [February 14, 2018, 6:29am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295 "2018-02-14T06:29:54Z")
Hai, I have been receiving the grokparsefailure error lately. Plz find the output that contains the "\_grokparsefailure" and my configuration files are mentioned below. Plz help.. #######################################… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=820) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=822)