# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=832 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 833 --- ## [Logstash.conf not found for after installing logstash](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004)
**Author:** [@SawyerFord](https://discuss.elastic.co/u/SawyerFord)\ **Replies:** 24\ **Last updated:** [January 29, 2018, 8:51pm UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004 "2018-01-29T20:51:37Z")
I have installed the logstash with the below link but I am not able to find logstash.conf in my system at the paths /etc/logstash/cont.d /etc/init/ /etc/init.d/ https://www.elastic.co/guide/en/logstash/current/insta… --- ## [Advice on writing output connector in Logstash](https://discuss.elastic.co/t/advice-on-writing-output-connector-in-logstash/117510)
**Author:** [@anup](https://discuss.elastic.co/u/anup)\ **Replies:** 1\ **Last updated:** [January 30, 2018, 6:43am UTC](https://discuss.elastic.co/t/advice-on-writing-output-connector-in-logstash/117510 "2018-01-30T06:43:19Z")
Hi, I want to discuss writing Logstash to Scalyr output connector. Any advice? --- ## [Pipelining is not working properly](https://discuss.elastic.co/t/pipelining-is-not-working-properly/117019)
**Author:** [@abhi210797](https://discuss.elastic.co/u/abhi210797)\ **Replies:** 4\ **Last updated:** [January 30, 2018, 6:31am UTC](https://discuss.elastic.co/t/pipelining-is-not-working-properly/117019 "2018-01-30T06:31:11Z")
\[image\] I am unable to understand the error. --- ## [Digging values out of embedded hashes](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191)
**Author:** [@Jason\_Brooks](https://discuss.elastic.co/u/Jason_Brooks)\ **Replies:** 4\ **Last updated:** [January 30, 2018, 12:04am UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191 "2018-01-30T00:04:21Z")
Hello, I have spent all day trying to do this, but I am pretty sure that a) not knowing enough ruby and b) not being familiar enough wth logstash is killing me. I am running logstash 6.1 on ubuntu 16.04LTS server. I h… --- ## [Question about automatic config reload](https://discuss.elastic.co/t/question-about-automatic-config-reload/117538)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [January 29, 2018, 10:52pm UTC](https://discuss.elastic.co/t/question-about-automatic-config-reload/117538 "2018-01-29T22:52:04Z")
Hi, If I start logstash with -r config, it will reload its configuration. I know it works well if I change the conf files directly. But will it also trigger a reload if I make changes to a referenced grok pattern file… --- ## [Could not load : can't convert nil into String](https://discuss.elastic.co/t/could-not-load-cant-convert-nil-into-string/117101)
**Author:** [@greenhorn](https://discuss.elastic.co/u/greenhorn)\ **Replies:** 8\ **Last updated:** [January 29, 2018, 9:08pm UTC](https://discuss.elastic.co/t/could-not-load-cant-convert-nil-into-string/117101 "2018-01-29T21:08:52Z")
When I use output { stdout { codec =\> rubydebug } } I end up filling up my logs files with the following. Could not load : can't convert nil into String My configuration is as follows. Grok Pattern File … --- ## [IF/THEN in output config not working properly](https://discuss.elastic.co/t/if-then-in-output-config-not-working-properly/117390)
**Author:** [@pvols1979](https://discuss.elastic.co/u/pvols1979)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 8:56pm UTC](https://discuss.elastic.co/t/if-then-in-output-config-not-working-properly/117390 "2018-01-29T20:56:27Z")
I have created an output config for Logstash and attempted to specify which index for a few different feeds to go by using if then else statements in the config file. Reagardless of what I try, Data I do not want in the… --- ## [How to pass dynamic parameters in Logstash input](https://discuss.elastic.co/t/how-to-pass-dynamic-parameters-in-logstash-input/117502)
**Author:** [@rajeshb44](https://discuss.elastic.co/u/rajeshb44)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 8:54pm UTC](https://discuss.elastic.co/t/how-to-pass-dynamic-parameters-in-logstash-input/117502 "2018-01-29T20:54:02Z")
How to pass dynamic parameters in Logstash input --- ## [Debugging a filter - optimizing for speed. How to measure speed of a plugin?](https://discuss.elastic.co/t/debugging-a-filter-optimizing-for-speed-how-to-measure-speed-of-a-plugin/117483)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 8:49pm UTC](https://discuss.elastic.co/t/debugging-a-filter-optimizing-for-speed-how-to-measure-speed-of-a-plugin/117483 "2018-01-29T20:49:33Z")
Hi all, To be able to monitor how fast or slow my logstash filter configurations are, I generally take a tick as first filter and I take a tick on last filter and calculate the time difference between the ticks. Ticks a… --- ## [User setting - looking for best practice](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264)
**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Replies:** 4\ **Last updated:** [January 29, 2018, 8:27pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264 "2018-01-29T20:27:29Z")
Hi, I am running logstash on my centOS machine using a user that I created "elastic" This user needs to be able to run data ingestion for various tests. This user needs to write to /var/log/logstash And to /usr/share/l… --- ## [Logstash elasticsearch host name](https://discuss.elastic.co/t/logstash-elasticsearch-host-name/117134)
**Author:** [@Bob\_Donat](https://discuss.elastic.co/u/Bob_Donat)\ **Replies:** 2\ **Last updated:** [January 29, 2018, 8:16pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-host-name/117134 "2018-01-29T20:16:05Z")
I have a elasticsearch, logstash, and kibana deployment on kubernetes. When the logstash,conf file is created I get the following: elasticsearch { hosts =\> \["elasticsearch.default.svc.cluster.local:9200"\] } Where is… --- ## [Porspector and harvester](https://discuss.elastic.co/t/porspector-and-harvester/117517)
**Author:** [@Bruno\_Ramos\_Dias](https://discuss.elastic.co/u/Bruno_Ramos_Dias)\ **Replies:** 0\ **Last updated:** [January 29, 2018, 7:31pm UTC](https://discuss.elastic.co/t/porspector-and-harvester/117517 "2018-01-29T19:31:44Z")
Somethins seems to be wrong on my configurations of filebat on to logsstash This is my log when running file beat pointed at a logstash on another server: 2018-01-29T15:48:06-03:00 DBG \[prospector\] Harvester for file … --- ## [Pipeline.yml not working](https://discuss.elastic.co/t/pipeline-yml-not-working/117120)
**Author:** [@davehs30](https://discuss.elastic.co/u/davehs30)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 7:09pm UTC](https://discuss.elastic.co/t/pipeline-yml-not-working/117120 "2018-01-29T19:09:16Z")
on logstash 6.1.2 , I have commented out the path.config in logstash.yml as well as remove the --path-settings from the systemd service file. I get no error messages in the log, even when I have no pipelines.yml files… --- ## [If condition statement in Logstash](https://discuss.elastic.co/t/if-condition-statement-in-logstash/117511)
**Author:** [@rpendela](https://discuss.elastic.co/u/rpendela)\ **Replies:** 0\ **Last updated:** [January 29, 2018, 6:33pm UTC](https://discuss.elastic.co/t/if-condition-statement-in-logstash/117511 "2018-01-29T18:33:47Z")
Continuing the discussion from Logstash or condition in if statement: @magnusbaeck, I have a DeviceName filed in my logs and I am trying to add a tag based on below condition but not seeing any tags added to the logs … --- ## [One or more logstash process?](https://discuss.elastic.co/t/one-or-more-logstash-process/117171)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 5\ **Last updated:** [January 29, 2018, 5:27pm UTC](https://discuss.elastic.co/t/one-or-more-logstash-process/117171 "2018-01-29T17:27:39Z")
I have different source log and I would like to know the performance, if it is better to have a single logstash process to load the log into elasticsearch for all log type or it is better to have a single logstash proces… --- ## [Filebeat and logstash-shipper](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487)
**Author:** [@ggutsche](https://discuss.elastic.co/u/ggutsche)\ **Replies:** 4\ **Last updated:** [January 29, 2018, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487 "2018-01-29T16:07:42Z")
Hi! I try to integrate some new stages to our older ELK-Stack. For the new stages I would like to use filebeat and I want to connect to the logstash-shipper. But I get the error message from filebeat 18/01/29 15:35:13.… --- ## [IDE for contributing to plugins and Logstash](https://discuss.elastic.co/t/ide-for-contributing-to-plugins-and-logstash/117330)
**Author:** [@AbdulHaseebHussain](https://discuss.elastic.co/u/AbdulHaseebHussain)\ **Replies:** 1\ **Last updated:** [January 29, 2018, 3:31pm UTC](https://discuss.elastic.co/t/ide-for-contributing-to-plugins-and-logstash/117330 "2018-01-29T15:31:53Z")
I have previously contributed to some Ruby only Plugins, I used Sublime Text Editor for these, now I would like to contribute to Logstash and some of the plugins that are mixture of Java and Ruby. When I try to open the … --- ## [Logstash transaction processing](https://discuss.elastic.co/t/logstash-transaction-processing/117047)
**Author:** [@Monica1](https://discuss.elastic.co/u/Monica1)\ **Replies:** 4\ **Last updated:** [January 29, 2018, 2:59pm UTC](https://discuss.elastic.co/t/logstash-transaction-processing/117047 "2018-01-29T14:59:52Z")
Hi, I am looking for transaction specific processing in logstash. For example., I am having Linux server having one user account 'aaa' having admin access. Incase if 'aaa' is trying to login to one Linux server with mu… --- ## [Info message "No config files found in path" - doesn't make any sense](https://discuss.elastic.co/t/info-message-no-config-files-found-in-path-doesnt-make-any-sense/113827)
**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Replies:** 6\ **Last updated:** [January 29, 2018, 2:37pm UTC](https://discuss.elastic.co/t/info-message-no-config-files-found-in-path-doesnt-make-any-sense/113827 "2018-01-29T14:37:19Z")
Hi, I have been using 2 files for a long time /path/to/logstash1.conf /path/to/logstash2.conf When switching to pipelines.yml I get an error that tells me no config files found in path (all correct path and file name… --- ## [Infinite plugin restart](https://discuss.elastic.co/t/infinite-plugin-restart/117474)
**Author:** [@puneetbaijal](https://discuss.elastic.co/u/puneetbaijal)\ **Replies:** 0\ **Last updated:** [January 29, 2018, 2:17pm UTC](https://discuss.elastic.co/t/infinite-plugin-restart/117474 "2018-01-29T14:17:02Z")
Hi, I'm using Logstash 6.1 with the JDBC input plugin after upgrading from 5.2, and noticed a new behavior that was not there earlier. Earlier when Logstash was not able to connect to the database or ran into an SQL er… --- ## [Logstash errors on imap input multiple languages](https://discuss.elastic.co/t/logstash-errors-on-imap-input-multiple-languages/116498)
**Author:** [@redacted](https://discuss.elastic.co/u/redacted)\ **Replies:** 4\ **Last updated:** [January 29, 2018, 1:57pm UTC](https://discuss.elastic.co/t/logstash-errors-on-imap-input-multiple-languages/116498 "2018-01-29T13:57:22Z")
I am working the the imap plugin and all seems to work well until an email with non english characters comes through. Logstash then fails then restarts. The error I am seeing is \[2018-01-22T10:00:40,212\]\[ERROR\]\[logstas… --- ## [Error type mapper](https://discuss.elastic.co/t/error-type-mapper/117162)
**Author:** [@Anonymous1](https://discuss.elastic.co/u/Anonymous1)\ **Replies:** 2\ **Last updated:** [January 29, 2018, 1:21pm UTC](https://discuss.elastic.co/t/error-type-mapper/117162 "2018-01-29T13:21:26Z")
Good afternoon. I can not figure out the problem. Input json { "@message":"execution error \[неверный синтаксис для типа timestamp with time zone: \\"Invalid date\\"\]", "timestamp":"2018-01-26T07:23:15+00:00", "@fields":{… --- ## [\[main\]\>worker0 ERROR Unable to copy file /var/log/logstash/logstash-plain-2018-01-23.log to /var/log/logstash/logstash-plain-2018-01-23.log](https://discuss.elastic.co/t/main-worker0-error-unable-to-copy-file-var-log-logstash-logstash-plain-2018-01-23-log-to-var-log-logstash-logstash-plain-2018-01-23-log/116714)
**Author:** [@pedrorochagoncalves](https://discuss.elastic.co/u/pedrorochagoncalves)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 11:41am UTC](https://discuss.elastic.co/t/main-worker0-error-unable-to-copy-file-var-log-logstash-logstash-plain-2018-01-23-log-to-var-log-logstash-logstash-plain-2018-01-23-log/116714 "2018-01-29T11:41:00Z")
Hi, This is my first post here, so please excuse any mistakes on my end. :slight\_smile: We have a couple of servers running logstash 5.6.3-1 and we've recently found this article here: We configured our log4j2.proper… --- ## [Logstash Output Elasticsearch bulk\_path](https://discuss.elastic.co/t/logstash-output-elasticsearch-bulk-path/117031)
**Author:** [@TclasenITVT](https://discuss.elastic.co/u/TclasenITVT)\ **Replies:** 6\ **Last updated:** [January 29, 2018, 11:04am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-bulk-path/117031 "2018-01-29T11:04:55Z")
Maybe I just don't understood the Documentation of bulk\_path but as I understood you would use bulk\_path to specifiy the index and then logstash automatically appends /\_bulk. I noticed running Logstash 6.1.1 and Elastics… --- ## [Dateparsefailure - error Logstash](https://discuss.elastic.co/t/dateparsefailure-error-logstash/117433)
**Author:** [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Replies:** 2\ **Last updated:** [January 29, 2018, 11:02am UTC](https://discuss.elastic.co/t/dateparsefailure-error-logstash/117433 "2018-01-29T11:02:42Z")
I'm getting \[0\] "\_dateparsefailure" while running logstash config file: date { match =\> \["date\_time", "dd-MM-yyyy hh:mm:ss"\] target =\> "date\_time" } Input CSV file: 29-01-2018 00:10:01 Am I missing something he… --- ## [Translate filter plugin not reading updated file](https://discuss.elastic.co/t/translate-filter-plugin-not-reading-updated-file/117401)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 10:46am UTC](https://discuss.elastic.co/t/translate-filter-plugin-not-reading-updated-file/117401 "2018-01-29T10:46:39Z")
Dear Community, We are Using Logstash 2.1 version, facing issue while using translate filter even refresh interval has applied. Logstah is able to identify the new entries added to the YAML file but not able to read th… --- ## [Logstash f5-LTM doesnt working](https://discuss.elastic.co/t/logstash-f5-ltm-doesnt-working/117428)
**Author:** [@Noam](https://discuss.elastic.co/u/Noam)\ **Replies:** 0\ **Last updated:** [January 29, 2018, 10:05am UTC](https://discuss.elastic.co/t/logstash-f5-ltm-doesnt-working/117428 "2018-01-29T10:05:39Z")
Hey, I have a problem with the f5-LTM of my Logstash environment. I got 5 servers with Logstash installed, and the LTM doesn't work with more than 2 servers. I sent big mass of http requests to check my Logstash envir… --- ## [Kinesis input plugin received event rate spikes after pipeline reload](https://discuss.elastic.co/t/kinesis-input-plugin-received-event-rate-spikes-after-pipeline-reload/117426)
**Author:** [@pcnc](https://discuss.elastic.co/u/pcnc)\ **Replies:** 0\ **Last updated:** [January 29, 2018, 9:22am UTC](https://discuss.elastic.co/t/kinesis-input-plugin-received-event-rate-spikes-after-pipeline-reload/117426 "2018-01-29T09:22:31Z")
Hello, We are currently using the kinesis input plugin for Logstash (https://github.com/logstash-plugins/logstash-input-kinesis) together with the basic XPack plugin, which allows us to monitor event receive and emit ra… --- ## [Invalid frame](https://discuss.elastic.co/t/invalid-frame/117071)
**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\ **Replies:** 2\ **Last updated:** [January 29, 2018, 8:50am UTC](https://discuss.elastic.co/t/invalid-frame/117071 "2018-01-29T08:50:46Z")
Hi all, i'm sending logs with filebeat to logstash, but i receive the following error: \[2018-01-25T16:46:48,630\]\[INFO \]\[org.logstash.beats.BeatsHandler\] \[local: 172.16.0.4:5043, remote: 172.16.0.64:48316\] Exception: org… --- ## [Help in importing Geo location data to Elasticsearch using logstash](https://discuss.elastic.co/t/help-in-importing-geo-location-data-to-elasticsearch-using-logstash/117062)
**Author:** [@Prakash\_Punj](https://discuss.elastic.co/u/Prakash_Punj)\ **Replies:** 1\ **Last updated:** [January 29, 2018, 8:39am UTC](https://discuss.elastic.co/t/help-in-importing-geo-location-data-to-elasticsearch-using-logstash/117062 "2018-01-29T08:39:00Z")
Hi !, New to ELK so don't understand a bunch of thing here. I have a set of data in a csv with following fields: Longitude, Latitude, Location1 -76.67759, 39.29402, "(39.2940200000, -76.6775900000)" I am trying to… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=831) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=833)