# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=848 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 849 --- ## [Logstasg config error The given configuration is invalid. Reason: Expected one of #, {, } at line 13, column 44 (byte 286) after filter {](https://discuss.elastic.co/t/logstasg-config-error-the-given-configuration-is-invalid-reason-expected-one-of-at-line-13-column-44-byte-286-after-filter/113739)
**Author:** [@Abdur\_Raqeeb1](https://discuss.elastic.co/u/Abdur_Raqeeb1)\ **Replies:** 2\ **Last updated:** [January 2, 2018, 12:21pm UTC](https://discuss.elastic.co/t/logstasg-config-error-the-given-configuration-is-invalid-reason-expected-one-of-at-line-13-column-44-byte-286-after-filter/113739 "2018-01-02T12:21:04Z")
Myself getting an below error while testing the config file The given configuration is invalid. Reason: Expected one of #, {, } at line 13, column 135 (byte 377) after filter { if \[type\] == "syslog" { grok { match =\> … --- ## [Multiline string parsed from filebeat reached Logstash- Unable to get desired output](https://discuss.elastic.co/t/multiline-string-parsed-from-filebeat-reached-logstash-unable-to-get-desired-output/113178)
**Author:** [@Mohammed\_Ayaz](https://discuss.elastic.co/u/Mohammed_Ayaz)\ **Replies:** 1\ **Last updated:** [January 2, 2018, 10:49am UTC](https://discuss.elastic.co/t/multiline-string-parsed-from-filebeat-reached-logstash-unable-to-get-desired-output/113178 "2018-01-02T10:49:14Z")
Hey Elastic Geeks, I have a multiline single event that have been already parsed form filebeat. I am receiving it in Logstash as "message": """ 06/12/2017 00:47:00 - DEBUG : PP1: 1 06/12/2017 00:47:00 - DEBUG : PP2: … --- ## [Grok in Logstash not working](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675)
**Author:** [@Bikash\_Behuria](https://discuss.elastic.co/u/Bikash_Behuria)\ **Replies:** 6\ **Last updated:** [January 2, 2018, 9:57am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675 "2018-01-02T09:57:53Z")
I wanted to parse application logs which has information like timestamp , host name , message , log level etc. When I am using Grok pattern , I dont see the correct value is being assigned to the respscive variable. F… --- ## [Is it possible to use HTTP input and S3 input plugin together in logstash](https://discuss.elastic.co/t/is-it-possible-to-use-http-input-and-s3-input-plugin-together-in-logstash/113408)
**Author:** [@Vinish\_Soman](https://discuss.elastic.co/u/Vinish_Soman)\ **Replies:** 3\ **Last updated:** [January 2, 2018, 8:48am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-http-input-and-s3-input-plugin-together-in-logstash/113408 "2018-01-02T08:48:15Z")
We are trying to make S3 input prefix as dynamic value. s3 { bucket =\> "bucketName" aws\_credentials\_file =\> "/root/logstash-5.3.0/config/aws\_credentials.yaml" delete =\> false interval =\> 60 # seconds prefix =\> "AWS… --- ## [My logstash running sometime have \[Regexp Interrupted\] exception then it's dead](https://discuss.elastic.co/t/my-logstash-running-sometime-have-regexp-interrupted-exception-then-its-dead/113271)
**Author:** [@Walter\_Xue](https://discuss.elastic.co/u/Walter_Xue)\ **Replies:** 3\ **Last updated:** [January 2, 2018, 8:41am UTC](https://discuss.elastic.co/t/my-logstash-running-sometime-have-regexp-interrupted-exception-then-its-dead/113271 "2018-01-02T08:41:09Z")
Logstash Version 5.6.4 Elasticsearch Version 5.6.4 Logstash Config filter{ if "beats\_input\_codec\_plain\_applied" in \[tags\] { mutate { remove\_tag =\> \["beats\_input\_codec\_plain\_applied"\] } } if "\_geoip\_lookup\_failur… --- ## [The geoip error in logstash](https://discuss.elastic.co/t/the-geoip-error-in-logstash/113270)
**Author:** [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Replies:** 2\ **Last updated:** [January 2, 2018, 3:39am UTC](https://discuss.elastic.co/t/the-geoip-error-in-logstash/113270 "2018-01-02T03:39:37Z")
I am now using the netflow module in my logtash,But i found a wired thing. In my logstash i can see hte geoip.cityname is framingham.But i found the destination ip address is a private address(10.140.50.155).Where is th… --- ## [Logstash docker image doesn't connect to elasticsearch image](https://discuss.elastic.co/t/logstash-docker-image-doesnt-connect-to-elasticsearch-image/113691)
**Author:** [@jeancharles](https://discuss.elastic.co/u/jeancharles)\ **Replies:** 2\ **Last updated:** [January 1, 2018, 6:09pm UTC](https://discuss.elastic.co/t/logstash-docker-image-doesnt-connect-to-elasticsearch-image/113691 "2018-01-01T18:09:19Z")
Hi, I'm a new user of Elasticsearch / Kibana / Logstash with docker images. I launched the images using the following commands: docker run -d -p 9200:9200 -p 9300:9300 --network=elastic -it --rm --name elasticsearch -… --- ## [Invalid format (illegal\_argument\_exception)](https://discuss.elastic.co/t/invalid-format-illegal-argument-exception/112422)
**Author:** [@Aman\_Verma1](https://discuss.elastic.co/u/Aman_Verma1)\ **Replies:** 1\ **Last updated:** [January 1, 2018, 3:10pm UTC](https://discuss.elastic.co/t/invalid-format-illegal-argument-exception/112422 "2018-01-01T15:10:40Z")
Can someone help me understand the underlying issue here. I am using kv filter to parse URL query parameters and pushing them to dynamically named indexes. input { beats { port =\> 5045 } } filter { grok { .… --- ## [Index not being created in Elastic search - S3 as input -](https://discuss.elastic.co/t/index-not-being-created-in-elastic-search-s3-as-input/113661)
**Author:** [@elastico\_imp](https://discuss.elastic.co/u/elastico_imp)\ **Replies:** 4\ **Last updated:** [January 1, 2018, 3:00pm UTC](https://discuss.elastic.co/t/index-not-being-created-in-elastic-search-s3-as-input/113661 "2018-01-01T15:00:52Z")
please find the trace .. iam testing out S3 as input have Cloudtrail events in S3 buckets from all accounts. trying to ingest to ES. LS doesnt create index. --- ## [Password encryption in Logstash](https://discuss.elastic.co/t/password-encryption-in-logstash/113694)
**Author:** [@Sai\_Jana\_Selvakumar](https://discuss.elastic.co/u/Sai_Jana_Selvakumar)\ **Replies:** 1\ **Last updated:** [January 1, 2018, 2:42pm UTC](https://discuss.elastic.co/t/password-encryption-in-logstash/113694 "2018-01-01T14:42:35Z")
Hi, Is there any way to encrypt elasticsearch passwords in logstash. Instead of directly exposing it elasticsearch { hosts =\> \["host"\] index =\> "indexname" user =\> "elastic" password =\> "changeme" --- ## [How to effectively use multiline codec with a crazy long xml file?](https://discuss.elastic.co/t/how-to-effectively-use-multiline-codec-with-a-crazy-long-xml-file/112592)
**Author:** [@iam\_thadiyan](https://discuss.elastic.co/u/iam_thadiyan)\ **Replies:** 2\ **Last updated:** [January 1, 2018, 1:18pm UTC](https://discuss.elastic.co/t/how-to-effectively-use-multiline-codec-with-a-crazy-long-xml-file/112592 "2018-01-01T13:18:08Z")
I have an XML file from a production machine which has more than 600MBs worth of xml data (15000000 lines) This file is very important from analytics point of view. But I find it difficult to get the entire file to push… --- ## [Xml filter sometimes fails to parse files that have valid xml](https://discuss.elastic.co/t/xml-filter-sometimes-fails-to-parse-files-that-have-valid-xml/112758)
**Author:** [@iam\_thadiyan](https://discuss.elastic.co/u/iam_thadiyan)\ **Replies:** 1\ **Last updated:** [January 1, 2018, 1:17pm UTC](https://discuss.elastic.co/t/xml-filter-sometimes-fails-to-parse-files-that-have-valid-xml/112758 "2018-01-01T13:17:47Z")
I have the following xml - alot many of them, in fact. \ \ \T1\ \ \ \T2\ \ \ Sometimes I see that the multiline code doesn't reach the en… --- ## [Automate a logstash process for my conf file](https://discuss.elastic.co/t/automate-a-logstash-process-for-my-conf-file/113670)
**Author:** [@Vivek\_Nigam](https://discuss.elastic.co/u/Vivek_Nigam)\ **Replies:** 1\ **Last updated:** [January 1, 2018, 8:54am UTC](https://discuss.elastic.co/t/automate-a-logstash-process-for-my-conf-file/113670 "2018-01-01T08:54:07Z")
Hi, i configure mylog.conf for my server logs, every time i need to run command :"./logstash -f mylog.conf" to ingest data in to elastic search. can i automate to run given command permanently in background. --- ## [Indices Creation Failed in ES via Logstash from Filebeat](https://discuss.elastic.co/t/indices-creation-failed-in-es-via-logstash-from-filebeat/113666)
**Author:** [@No\_Name](https://discuss.elastic.co/u/No_Name)\ **Replies:** 5\ **Last updated:** [January 1, 2018, 6:07am UTC](https://discuss.elastic.co/t/indices-creation-failed-in-es-via-logstash-from-filebeat/113666 "2018-01-01T06:07:52Z")
Greetings, and Happy New Year! We have 2 filbeats (from different servers, IP\_A and IP\_B) are connecting to Logstash in IP\_C. Then we have the ES and Kibana set up in IP\_C too. The problem I'm facing is that I'm only ab… --- ## [Parsing lon/lat with logstash](https://discuss.elastic.co/t/parsing-lon-lat-with-logstash/113638)
**Author:** [@BR\_GONGALE](https://discuss.elastic.co/u/BR_GONGALE)\ **Replies:** 5\ **Last updated:** [January 1, 2018, 4:08am UTC](https://discuss.elastic.co/t/parsing-lon-lat-with-logstash/113638 "2018-01-01T04:08:47Z")
I am facing problem while trying to parse location to 24.7N,118.5W. How can parse it to location without removing the N and W from this format 24.7N,118.5W --- ## [Replace string within a pattern in ruby](https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232)
**Author:** [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\ **Replies:** 2\ **Last updated:** [December 31, 2017, 2:52pm UTC](https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232 "2017-12-31T14:52:01Z")
Trying to find out a way on how to replace a substring within nested curly brackets my input string in a single line: {"service": "service-2bc902c2", "report\_timestamp": "2017-12-18T12:58:32.545191", "service\_engine": … --- ## [How to restart ELK when it is stopped](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108)
**Author:** [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Replies:** 14\ **Last updated:** [December 31, 2017, 1:41pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108 "2017-12-31T13:41:30Z")
I am using ELK and the Twitter API to scrape data from twitter. It has been going for more than a week and suddenly stopped working. I am not sure if it is due to the "limits of total fields in index has been exceeded" e… --- ## [Issue with logstash-output-gelf plug-in install for logstash](https://discuss.elastic.co/t/issue-with-logstash-output-gelf-plug-in-install-for-logstash/113288)
**Author:** [@sagarsway](https://discuss.elastic.co/u/sagarsway)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:38pm UTC](https://discuss.elastic.co/t/issue-with-logstash-output-gelf-plug-in-install-for-logstash/113288 "2017-12-31T13:38:24Z")
I am using logstash-6.1.1 on linux While installing plug-in , I am getting following error, $ ./logstash-plugin install logstash-output-gelf Validating logstash-output-gelf Unable to download data from https://rubyge… --- ## [I am not able to see any output on my logstash and kibana.But pipeline is created successfully](https://discuss.elastic.co/t/i-am-not-able-to-see-any-output-on-my-logstash-and-kibana-but-pipeline-is-created-successfully/113277)
**Author:** [@sanjayzack](https://discuss.elastic.co/u/sanjayzack)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:37pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-see-any-output-on-my-logstash-and-kibana-but-pipeline-is-created-successfully/113277 "2017-12-31T13:37:57Z")
input { file { path =\> "C:\\Users\\Micronet1\\Desktop\\logstash-acess\\Main.log" codec =\> multiline { pattern =\> "^%{TIMESTAMP\_ISO8601}" negate =\> true what =\> previous } } } filter { if \[path\] == "Main" { grok { … --- ## [Syslog/UDP input plugin : No message receive from Dell Blade switch](https://discuss.elastic.co/t/syslog-udp-input-plugin-no-message-receive-from-dell-blade-switch/113190)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:29pm UTC](https://discuss.elastic.co/t/syslog-udp-input-plugin-no-message-receive-from-dell-blade-switch/113190 "2017-12-31T13:29:47Z")
I'm replacing existing syslog with ELK setup. I tried to send some devices syslog message, all messages are received by logstash \[ syslog Plugiin \] without any issue. EXCEPT "dell Blade switch". I don't know why. To en… --- ## [How we can create custom filter plugin in logstash?](https://discuss.elastic.co/t/how-we-can-create-custom-filter-plugin-in-logstash/113571)
**Author:** [@yash\_mangla](https://discuss.elastic.co/u/yash_mangla)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:27pm UTC](https://discuss.elastic.co/t/how-we-can-create-custom-filter-plugin-in-logstash/113571 "2017-12-31T13:27:25Z")
Hello Folks, I am using logstash 5.6.3 and I have written python script for parsing the some part of logs. i want to call this script from filter section of logstash. I look around almost all the ways to look into it.… --- ## [Facing issue in Stored Procedure Call in Logstash](https://discuss.elastic.co/t/facing-issue-in-stored-procedure-call-in-logstash/113406)
**Author:** [@Sahul\_Hameed\_B](https://discuss.elastic.co/u/Sahul_Hameed_B)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:25pm UTC](https://discuss.elastic.co/t/facing-issue-in-stored-procedure-call-in-logstash/113406 "2017-12-31T13:25:36Z")
I am Facing Error in Stored Procedure Call in Logstash JDBC Plugin.. This is my JDBC Input Plugin input { jdbc { jdbc\_driver\_library =\> "D:\\Elastic\\elasticsearch-6.0.0\\lib\\sqljdbc42.jar" jdbc\_driver\_class =\> "com.m… --- ## [Need help to parse JSON event](https://discuss.elastic.co/t/need-help-to-parse-json-event/113422)
**Author:** [@siddarth.talupula](https://discuss.elastic.co/u/siddarth.talupula)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:24pm UTC](https://discuss.elastic.co/t/need-help-to-parse-json-event/113422 "2017-12-31T13:24:35Z")
Hi All, My application event log contains events in this format: 12/20/2017 11:08:50 AM - ProlexicService - DEBUG - new value added to event array : { \*\* "eventEndTime": 1513701199,\*\* \*\* "eventInfo": {\*\* \*\* … --- ## [Netflow.conn\_id out of range?](https://discuss.elastic.co/t/netflow-conn-id-out-of-range/113363)
**Author:** [@Diogo](https://discuss.elastic.co/u/Diogo)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:23pm UTC](https://discuss.elastic.co/t/netflow-conn-id-out-of-range/113363 "2017-12-31T13:23:45Z")
Hi! After running Logstash with the Netflow module for a little less than two weeks, I started getting the message bellow in my logs: \[2017-12-27T20:33:49,547\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index eve… --- ## [Kibana not showing parsed message](https://discuss.elastic.co/t/kibana-not-showing-parsed-message/113416)
**Author:** [@anjali](https://discuss.elastic.co/u/anjali)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:18pm UTC](https://discuss.elastic.co/t/kibana-not-showing-parsed-message/113416 "2017-12-31T13:18:23Z")
Hello, I am parsing my input on logstash, but it is not showing in kibana (the whole message shows up as one). Is there any way to debug this? Thanks. --- ## [One hang config or one invalid config breaking all pipeline](https://discuss.elastic.co/t/one-hang-config-or-one-invalid-config-breaking-all-pipeline/113347)
**Author:** [@Ram\_Sharan\_Mittal](https://discuss.elastic.co/u/Ram_Sharan_Mittal)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 1:14pm UTC](https://discuss.elastic.co/t/one-hang-config-or-one-invalid-config-breaking-all-pipeline/113347 "2017-12-31T13:14:11Z")
Config folder getting used to load multiple config in config directory. If one output config hang all output config stop working. so is a way that can be defined so that if one output/filter/input config hang than it don… --- ## [Syslog - logstash](https://discuss.elastic.co/t/syslog-logstash/113468)
**Author:** [@talial](https://discuss.elastic.co/u/talial)\ **Replies:** 3\ **Last updated:** [December 31, 2017, 1:12pm UTC](https://discuss.elastic.co/t/syslog-logstash/113468 "2017-12-31T13:12:30Z")
Hi, I want to crate a centralized logsys for networking. Will includ syslogs from Cisco, Juniper, Fortigate, F5, SmartEdge, Check-Point from a lot of machines. My problem is how to config the logstash.conf that will b… --- ## [Question about JDBC input plugin's last\_run\_metadata\_path setting](https://discuss.elastic.co/t/question-about-jdbc-input-plugins-last-run-metadata-path-setting/112036)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 5\ **Last updated:** [December 31, 2017, 1:11pm UTC](https://discuss.elastic.co/t/question-about-jdbc-input-plugins-last-run-metadata-path-setting/112036 "2017-12-31T13:11:06Z")
I am using the last\_run\_metadata\_path do define where the file it uses for persistence is kept. The documentation says that the default value for this is "/home/ph/.logstash\_jdbc\_last\_run", but there is no such file or d… --- ## [Do filter plugins error if the field doesn't exist or is empty?](https://discuss.elastic.co/t/do-filter-plugins-error-if-the-field-doesnt-exist-or-is-empty/113027)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 10\ **Last updated:** [December 31, 2017, 1:10pm UTC](https://discuss.elastic.co/t/do-filter-plugins-error-if-the-field-doesnt-exist-or-is-empty/113027 "2017-12-31T13:10:28Z")
If I use the date filter plugin to parse a field that usually has a date, but sometimes is empty, does it throw an error? What about the JSON filter? Is there any need for me to have a config setting that says if \[field\]… --- ## [Date filter does not assign value to target field](https://discuss.elastic.co/t/date-filter-does-not-assign-value-to-target-field/112913)
**Author:** [@sramshey](https://discuss.elastic.co/u/sramshey)\ **Replies:** 3\ **Last updated:** [December 31, 2017, 1:05pm UTC](https://discuss.elastic.co/t/date-filter-does-not-assign-value-to-target-field/112913 "2017-12-31T13:05:54Z")
Hi- I'm having some trouble using a date filter in logstash. I am able to parse the date elements from the original log message into a custom field, but the date filter does not assign it to the @timestamp field and I do… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=847) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=849)