# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=829 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 830 --- ## [No geo\_point fields logstash 6](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 27\ **Last updated:** [February 3, 2018, 12:28am UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788 "2018-02-03T00:28:14Z")
No Compatible Fields: The "apache-access\_\*" index pattern does not contain any of the following field types: geo\_point Logstash geo config that worked fine for logstash 5.6 geoip { source =\> "clientip" target =\> … --- ## [Beats plugin will not start with "cipher not found"](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902)
**Author:** [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Replies:** 3\ **Last updated:** [February 2, 2018, 7:46pm UTC](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902 "2018-02-02T19:46:01Z")
ES 6.1.1 Kibana 6.1.1 Beats 6.1.2 All on Ubuntu 16.0.4 LTS When upgrading Logstash from 5.6 to 6.1, I am unable to use SSL when defining the beats plugin, it complains that the cipher is not available, and Logstash w… --- ## [Logstash-input-jdbc plugin download](https://discuss.elastic.co/t/logstash-input-jdbc-plugin-download/118273)
**Author:** [@jspeer](https://discuss.elastic.co/u/jspeer)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 7:25pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-plugin-download/118273 "2018-02-02T19:25:46Z")
Is there a location to download the plugin so it doesn't have to be compiled? I have to install all plugins offline, and this is the result of trying with the github zip /usr/share/logstash/bin/logstash-plugin install f… --- ## [Download Plugins Behind Proxy](https://discuss.elastic.co/t/download-plugins-behind-proxy/116601)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [February 2, 2018, 6:50pm UTC](https://discuss.elastic.co/t/download-plugins-behind-proxy/116601 "2018-02-02T18:50:29Z")
I've been banging my head against a wall trying to figure out where to put what settings to get this to work. Someone please don the Barney costume and walk me through this. Running ELK stack 6.1.1 on a Windows server … --- ## [Endless stream of logstash "No mapping found for \[@timestamp\] in order to sort on" after X-Pack install](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156)
**Author:** [@dlam](https://discuss.elastic.co/u/dlam)\ **Replies:** 4\ **Last updated:** [February 2, 2018, 4:32pm UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156 "2018-02-02T16:32:33Z")
I'm getting an endless stream of these "No mapping found for \[@timestamp\] in order to sort on" warnings in my logstash log. Anyone know how to stop them? here's what i was doing I needed more memory for my ELK inst… --- ## [Logstash stopped working after plugin install](https://discuss.elastic.co/t/logstash-stopped-working-after-plugin-install/118253)
**Author:** [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 4:16pm UTC](https://discuss.elastic.co/t/logstash-stopped-working-after-plugin-install/118253 "2018-02-02T16:16:19Z")
Hello, I've been using logstash for a while and today I tried to install a custom plugin (https://github.com/nipunarora/logstash-seq-plugin). So first I built the gem using gem build xxxxxx.gemspec Then I installed t… --- ## [Not write to Elastic search if filed is null](https://discuss.elastic.co/t/not-write-to-elastic-search-if-filed-is-null/118252)
**Author:** [@robertchen117](https://discuss.elastic.co/u/robertchen117)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 4:05pm UTC](https://discuss.elastic.co/t/not-write-to-elastic-search-if-filed-is-null/118252 "2018-02-02T16:05:52Z")
My log parsed by logstash with some fields are null string, message is like this: USR: NA, SID: null .... So SID is null, how to not write to ELK if field is "null" ? SID null --- ## [Logstash polling for closed index and stopping the log forwarding](https://discuss.elastic.co/t/logstash-polling-for-closed-index-and-stopping-the-log-forwarding/117208)
**Author:** [@Anjan\_Pratap](https://discuss.elastic.co/u/Anjan_Pratap)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:57pm UTC](https://discuss.elastic.co/t/logstash-polling-for-closed-index-and-stopping-the-log-forwarding/117208 "2018-02-02T13:57:18Z")
Hi, I am using logstash 5.6 with filebeat, rsyslog and kafka as inputs. I implemented a script to close the indices older than one month. I am seeing log messages in logstash about the closed indices for long time and … --- ## [Logstash parse too slow to elasticsearch](https://discuss.elastic.co/t/logstash-parse-too-slow-to-elasticsearch/118101)
**Author:** [@henriqueluz](https://discuss.elastic.co/u/henriqueluz)\ **Replies:** 8\ **Last updated:** [February 2, 2018, 1:42pm UTC](https://discuss.elastic.co/t/logstash-parse-too-slow-to-elasticsearch/118101 "2018-02-02T13:42:27Z")
Hello there, I'm trying to parse a large .csv file via Logstash to elasticsearch, but it is too slow, about 100 events per second, my .csv file has over a million events. I'm running both Logstash and Elasticsearch loc… --- ## [Suppress log msg](https://discuss.elastic.co/t/suppress-log-msg/118234)
**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 1:33pm UTC](https://discuss.elastic.co/t/suppress-log-msg/118234 "2018-02-02T13:33:24Z")
Hi all, in the LS logs i receive the following warn: \[2018-02-02T14:31:27,455\]\[WARN \]\[logstash.codecs.plain \] Received an event that has a different character encoding than you configured. {:text=\>"0\\x80\\u0006\\t\*\\x8… --- ## [Unable to find Filter plugin name :(](https://discuss.elastic.co/t/unable-to-find-filter-plugin-name/118214)
**Author:** [@madhur\_yadav](https://discuss.elastic.co/u/madhur_yadav)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:15pm UTC](https://discuss.elastic.co/t/unable-to-find-filter-plugin-name/118214 "2018-02-02T13:15:26Z")
I have build a custom plugin for my logstash. I made it's gemfile using gemspec file then i installed the plugin. when i check for my plugin with command: bin\\logstash-plugin list --verbose logstash-filter-jwt (0.1.0… --- ## [2 Grok In Same File](https://discuss.elastic.co/t/2-grok-in-same-file/118219)
**Author:** [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 12:09pm UTC](https://discuss.elastic.co/t/2-grok-in-same-file/118219 "2018-02-02T12:09:47Z")
How to use two type of grok in one conf file?? I have two type of logs in the same file but all the time the 1st grok is applied and it is failed to run :frowning: how to use two type of grokes in the same conf file ?? … --- ## [Behavior of Logstash in case of crash in combination with syslog](https://discuss.elastic.co/t/behavior-of-logstash-in-case-of-crash-in-combination-with-syslog/118213)
**Author:** [@itspecialistsimon](https://discuss.elastic.co/u/itspecialistsimon)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 10:52am UTC](https://discuss.elastic.co/t/behavior-of-logstash-in-case-of-crash-in-combination-with-syslog/118213 "2018-02-02T10:52:38Z")
Hi everyone, I'm quite new to ELK and want to know Logstash's behavior when it crashs. Assuming syslog is sending its data to Logstash and then Logstash suddenly crashs. What happens with the data syslog have already s… --- ## [Spliting log message](https://discuss.elastic.co/t/spliting-log-message/118181)
**Author:** [@rkshprb](https://discuss.elastic.co/u/rkshprb)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 9:59am UTC](https://discuss.elastic.co/t/spliting-log-message/118181 "2018-02-02T09:59:49Z")
I have generated logs in HPUX and shipped it to my elk server but logstash is reading those complete logs as one string. I want to split the GREEDYDATA field to generate specific fields. Is their any option in grok or an… --- ## [Config files for mutliple pipelines](https://discuss.elastic.co/t/config-files-for-mutliple-pipelines/115976)
**Author:** [@shubham\_kumar1](https://discuss.elastic.co/u/shubham_kumar1)\ **Replies:** 6\ **Last updated:** [February 2, 2018, 9:46am UTC](https://discuss.elastic.co/t/config-files-for-mutliple-pipelines/115976 "2018-02-02T09:46:39Z")
Hi, I am trying to configure two separate pipelines in logstash-6.1.1 through pipeline.yml. For each configuration file i am specifying same input and output. 1st\_pipeline.conf:- input{ beats{ port =\> 5044 } } fi… --- ## [Unable to Saperate Logs from Message Field](https://discuss.elastic.co/t/unable-to-saperate-logs-from-message-field/118176)
**Author:** [@happyvivek](https://discuss.elastic.co/u/happyvivek)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 7:37am UTC](https://discuss.elastic.co/t/unable-to-saperate-logs-from-message-field/118176 "2018-02-02T07:37:49Z")
Hi, My Log Files look like below.I am using multiline to combine all lines to previous lines till select\*. I want ResultSet value to be in different field. And rest of message in LOG field. Can somebody please help o… --- ## [How to read JSON input sent to Http input plugin in filter section](https://discuss.elastic.co/t/how-to-read-json-input-sent-to-http-input-plugin-in-filter-section/118090)
**Author:** [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)\ **Replies:** 3\ **Last updated:** [February 2, 2018, 7:19am UTC](https://discuss.elastic.co/t/how-to-read-json-input-sent-to-http-input-plugin-in-filter-section/118090 "2018-02-02T07:19:35Z")
Hi, I have sample http input plugin and posting json data to this plugin. I want to copy the json body into another field in order to standardize the output format. Invalid jsons are going into message field. I followed … --- ## [Validation of logstash config](https://discuss.elastic.co/t/validation-of-logstash-config/118105)
**Author:** [@Vafa\_Ronaghi](https://discuss.elastic.co/u/Vafa_Ronaghi)\ **Replies:** 3\ **Last updated:** [February 2, 2018, 7:15am UTC](https://discuss.elastic.co/t/validation-of-logstash-config/118105 "2018-02-02T07:15:37Z")
Hello all, Following situation: I am running a logstash-5.6.4 in a docker container. This is an ansible project in a gitlab. Everytime I change something in logstash config, gitlab starts a pipeline to build all re… --- ## [Ruby syntax error after updating Logstash to 5.6.7](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028)
**Author:** [@vicpav](https://discuss.elastic.co/u/vicpav)\ **Replies:** 3\ **Last updated:** [February 2, 2018, 7:11am UTC](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028 "2018-02-02T07:11:54Z")
To compensate the logging schema violations and to get Elasticsearch indexing happy I am trying to catch log lines where the field message\_json.msgObject.products is an array of strings instead of array of hashes. In suc… --- ## [Grok parser](https://discuss.elastic.co/t/grok-parser/118089)
**Author:** [@pp\_macrix](https://discuss.elastic.co/u/pp_macrix)\ **Replies:** 0\ **Last updated:** [February 1, 2018, 7:11pm UTC](https://discuss.elastic.co/t/grok-parser/118089 "2018-02-01T19:11:27Z")
I am trying to parse my log files. It was working however there is a new requirement and I need new field from the parsed logs. Logs are more or less: |2018-02-01 13:48:00.882|\[v2.8.0.0\]|DEBUG|\[EndpointFirst\] |Session … --- ## [GeoIp-problems](https://discuss.elastic.co/t/geoip-problems/116472)
**Author:** [@eebee](https://discuss.elastic.co/u/eebee)\ **Replies:** 5\ **Last updated:** [February 2, 2018, 6:06am UTC](https://discuss.elastic.co/t/geoip-problems/116472 "2018-02-02T06:06:42Z")
I'm trying to filter out the GeoIp from the log I'm ingesting into Elasticsearch. The log pattern is like this: {"@message":"Successful api request","@timestamp":"2018-01-22T08:24:00.162Z","@fields":{"origin":"193.xx.x… --- ## [Grok type](https://discuss.elastic.co/t/grok-type/118014)
**Author:** [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\ **Replies:** 8\ **Last updated:** [February 2, 2018, 4:49am UTC](https://discuss.elastic.co/t/grok-type/118014 "2018-02-02T04:49:45Z")
what grok i should use for " (http-WEB0001VR%2F10.351.100.19-1000-15) " --- ## [My translate config isn't working](https://discuss.elastic.co/t/my-translate-config-isnt-working/118102)
**Author:** [@jhashman](https://discuss.elastic.co/u/jhashman)\ **Replies:** 2\ **Last updated:** [February 2, 2018, 4:18am UTC](https://discuss.elastic.co/t/my-translate-config-isnt-working/118102 "2018-02-02T04:18:52Z")
filter { if \[eventlog\_category\] == "Directory Service Changes" { ruby { code =\> "event.set('gpo\_guid', event.get('ObjectDN')\[4..39\])" } translate { field =\> "gpo\_guid" destination =\> "gpo\_name" dictionary\_path… --- ## [About a date bug](https://discuss.elastic.co/t/about-a-date-bug/118142)
**Author:** [@yangyijin](https://discuss.elastic.co/u/yangyijin)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 2:42am UTC](https://discuss.elastic.co/t/about-a-date-bug/118142 "2018-02-02T02:42:26Z")
for in my logstash conf: index =\> "system-syslog-%{+YYYYMMDD}" And in the kibana page it shows "\_index": "system-syslog-20180233" for right it should be system-syslog-20180202 How could i fix it... I just use it fro… --- ## [Jboss log to Json](https://discuss.elastic.co/t/jboss-log-to-json/117788)
**Author:** [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:23am UTC](https://discuss.elastic.co/t/jboss-log-to-json/117788 "2018-02-02T01:23:56Z")
Hi, Can i give in parameter as jboss log in logstash and out parameter as json from logstash to elastic search ?? if yes please help out with this log example 2018-01-31 00:00:00,633 INFO \[STDOUT\] (http-xxxx%xxx.xx.x… --- ## [Logstash plugins offline installation](https://discuss.elastic.co/t/logstash-plugins-offline-installation/117855)
**Author:** [@sesaravanan](https://discuss.elastic.co/u/sesaravanan)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:12am UTC](https://discuss.elastic.co/t/logstash-plugins-offline-installation/117855 "2018-02-02T01:12:54Z")
Hi, I want to download and install all latest version of logstash plugins ? could someone help me with right pointer? Saravanan --- ## [Move files from input to stage then output directory with logstash](https://discuss.elastic.co/t/move-files-from-input-to-stage-then-output-directory-with-logstash/118039)
**Author:** [@Ram\_Sharan\_Mittal](https://discuss.elastic.co/u/Ram_Sharan_Mittal)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:08am UTC](https://discuss.elastic.co/t/move-files-from-input-to-stage-then-output-directory-with-logstash/118039 "2018-02-02T01:08:35Z")
There is metrics file which get generated every 1 min in a input directory and like to move to stage and then output directory to show case that file have been processed. Can do this usecase with logstash with help of ex… --- ## [How to create index for application logs in Logstash](https://discuss.elastic.co/t/how-to-create-index-for-application-logs-in-logstash/118116)
**Author:** [@Vikneswar](https://discuss.elastic.co/u/Vikneswar)\ **Replies:** 3\ **Last updated:** [February 1, 2018, 10:54pm UTC](https://discuss.elastic.co/t/how-to-create-index-for-application-logs-in-logstash/118116 "2018-02-01T22:54:21Z")
I need to create index for below application log file in logstash , can any one help me \[2018-02-01 15:52:31,107\]\[WARN\]\[\[ACTIVE\] ExecuteThread: '11' for queue: 'weblogic.kernel.Default (self-tuning)'\]\[com.att.dda2.ws.he… --- ## [Prevent new document with the same docuemnt id replacing the old one](https://discuss.elastic.co/t/prevent-new-document-with-the-same-docuemnt-id-replacing-the-old-one/118104)
**Author:** [@Tao\_Liu1](https://discuss.elastic.co/u/Tao_Liu1)\ **Replies:** 4\ **Last updated:** [February 1, 2018, 9:42pm UTC](https://discuss.elastic.co/t/prevent-new-document-with-the-same-docuemnt-id-replacing-the-old-one/118104 "2018-02-01T21:42:35Z")
Hi, I am using a custom document id to avoid duplicate in Logstash. However, I notice that if the same document with the same document id gets parsed to the same index, it will replace the original one, which means @tim… --- ## [Logstash/Beats tagging not working?](https://discuss.elastic.co/t/logstash-beats-tagging-not-working/118019)
**Author:** [@Amgryptio](https://discuss.elastic.co/u/Amgryptio)\ **Replies:** 3\ **Last updated:** [February 1, 2018, 9:04pm UTC](https://discuss.elastic.co/t/logstash-beats-tagging-not-working/118019 "2018-02-01T21:04:08Z")
Hi, I'm attempting to add tags via beats input into logstash using: input { beats { host =\> "192.168.1.20" port =\> 5045 client\_inactivity\_timeout =\> 0 … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=828) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=830)