# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=849 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 850 --- ## [Convert a field string to time](https://discuss.elastic.co/t/convert-a-field-string-to-time/113339)
**Author:** [@Vivek\_Nigam](https://discuss.elastic.co/u/Vivek_Nigam)\ **Replies:** 4\ **Last updated:** [December 31, 2017, 1:02pm UTC](https://discuss.elastic.co/t/convert-a-field-string-to-time/113339 "2017-12-31T13:02:47Z")
Hi, my string value is like 03:40:15 , want to convert it to time field without date. can i do it?? --- ## [Logstash Bandwidth Accounting](https://discuss.elastic.co/t/logstash-bandwidth-accounting/112711)
**Author:** [@ChrisMorley](https://discuss.elastic.co/u/ChrisMorley)\ **Replies:** 3\ **Last updated:** [December 31, 2017, 12:58pm UTC](https://discuss.elastic.co/t/logstash-bandwidth-accounting/112711 "2017-12-31T12:58:11Z")
Hi all, very new to ES and i started writing my own logging function writing direct to Elasticsearch with C# to log network packet counters on a minute basis (IP pairs, bytes in/out), and run a query by sum over multiple… --- ## [Logstash outout to Elastic search](https://discuss.elastic.co/t/logstash-outout-to-elastic-search/113472)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 1\ **Last updated:** [December 31, 2017, 10:04am UTC](https://discuss.elastic.co/t/logstash-outout-to-elastic-search/113472 "2017-12-31T10:04:55Z")
Hi All, I am trying to send logstash output to Elastic Search Cluster , below the i am defining output { elasticsearch { hosts =\> \["node1:9200 , node2:9200 , node3:9200"\] … --- ## [How can I modify the netflow module?](https://discuss.elastic.co/t/how-can-i-modify-the-netflow-module/113644)
**Author:** [@Michael\_Tsikerdekis](https://discuss.elastic.co/u/Michael_Tsikerdekis)\ **Replies:** 0\ **Last updated:** [December 30, 2017, 11:20pm UTC](https://discuss.elastic.co/t/how-can-i-modify-the-netflow-module/113644 "2017-12-30T23:20:16Z")
I have been editing the file /usr/share/logstash/modules/netflow/configuration/elasticsearch/netflow.json and even changed the meta version among other fields. Problem is that when I call sudo systemctl stop logstash.se… --- ## [Passing data from file through Logstash to Kibana](https://discuss.elastic.co/t/passing-data-from-file-through-logstash-to-kibana/113515)
**Author:** [@Jeff\_Haynes](https://discuss.elastic.co/u/Jeff_Haynes)\ **Replies:** 3\ **Last updated:** [December 30, 2017, 9:20pm UTC](https://discuss.elastic.co/t/passing-data-from-file-through-logstash-to-kibana/113515 "2017-12-30T21:20:58Z")
Hello, I am new to ELK and have been trying for a few weeks to get things to work. I am using Elasticsearch 6. I have JSON files being added to /var/local/ that have been structured for elasticsearch sample JSON file \[… --- ## [Problems with mutate and python](https://discuss.elastic.co/t/problems-with-mutate-and-python/113584)
**Author:** [@dabyd](https://discuss.elastic.co/u/dabyd)\ **Replies:** 1\ **Last updated:** [December 30, 2017, 8:55pm UTC](https://discuss.elastic.co/t/problems-with-mutate-and-python/113584 "2017-12-30T20:55:44Z")
Hello, I have prblems with mutate. I have problems separating the message into variables. For the variable "@campo1" the operation is correct, but for the other variables it does not work. it includes quotes or question… --- ## [Why does Logstash not clear DLQ after successful fixes?](https://discuss.elastic.co/t/why-does-logstash-not-clear-dlq-after-successful-fixes/113618)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 3\ **Last updated:** [December 29, 2017, 11:22pm UTC](https://discuss.elastic.co/t/why-does-logstash-not-clear-dlq-after-successful-fixes/113618 "2017-12-29T23:22:40Z")
I have a main pipeline that will sometimes send docs to its Dead Letter Queue. I have another fixes pipeline that fixes those issues. However, even though I can see that fixes is fixing and successfully processing the do… --- ## [Logstash does not start; says "could not find jruby in ..."](https://discuss.elastic.co/t/logstash-does-not-start-says-could-not-find-jruby-in/113500)
**Author:** [@enrique3000](https://discuss.elastic.co/u/enrique3000)\ **Replies:** 2\ **Last updated:** [December 29, 2017, 8:06pm UTC](https://discuss.elastic.co/t/logstash-does-not-start-says-could-not-find-jruby-in/113500 "2017-12-29T20:06:36Z")
Best regard. I would like to know why it does not start the Logstash (version 6.1.1) that I have installed locally. After locating in DOS in the directory where I have it installed ("c: \\ Elastic Stack \\ logstash-6.1.1")… --- ## [Problems parsing time in logstash with date filter](https://discuss.elastic.co/t/problems-parsing-time-in-logstash-with-date-filter/113582)
**Author:** [@anchasis](https://discuss.elastic.co/u/anchasis)\ **Replies:** 1\ **Last updated:** [December 29, 2017, 3:04pm UTC](https://discuss.elastic.co/t/problems-parsing-time-in-logstash-with-date-filter/113582 "2017-12-29T15:04:56Z")
I have a problem parsing a timestamp of the format "2017-06-28T10:28:18.000Z". It should match both "ISO8601" and "YYYY-MM-dd'T'HH:mm:ss.SSS'Z'" but apparently it doesn't. All other formats get parsed correctly I tried… --- ## [How to convert src\_ip to ip](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557)
**Author:** [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\ **Replies:** 11\ **Last updated:** [December 29, 2017, 12:21pm UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557 "2017-12-29T12:21:55Z")
Just succesfull read my Cisco ASA logs, but I am now looking for a way to convert my src\_ip (string) in a way that I am able to use it as a geo\_point on the Coordinate Map. Can anyone tell me how my filter section should… --- ## [Help with aggregate filter](https://discuss.elastic.co/t/help-with-aggregate-filter/113589)
**Author:** [@Mazhar](https://discuss.elastic.co/u/Mazhar)\ **Replies:** 0\ **Last updated:** [December 29, 2017, 12:30pm UTC](https://discuss.elastic.co/t/help-with-aggregate-filter/113589 "2017-12-29T12:30:45Z")
Hi, I have the following event to which I need to apply aggregation on "Logon ID", ------- SAMPLE ----- message:An operation was performed on an object. Subject : Security ID: S-1-5-18 Account Name: JB5VN3$ Account Do… --- ## [Cisco ASA netflow: Ignoring Netflow version v15409](https://discuss.elastic.co/t/cisco-asa-netflow-ignoring-netflow-version-v15409/113451)
**Author:** [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\ **Replies:** 1\ **Last updated:** [December 29, 2017, 9:11am UTC](https://discuss.elastic.co/t/cisco-asa-netflow-ignoring-netflow-version-v15409/113451 "2017-12-29T09:11:36Z")
Trying to "push" my Cisco ASA logs to Logstash. This results in an "Ignoring Netflow version v15409" error. .conf: input { udp { port =\> 9996 type =\> "netflow" codec =\> netflow { versions =\> \[9\] } } } output … --- ## [Logstash Fingerprint Plugin: How to Exclude @timestamp](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498)
**Author:** [@shreyask](https://discuss.elastic.co/u/shreyask)\ **Replies:** 9\ **Last updated:** [December 29, 2017, 8:45am UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498 "2017-12-29T08:45:11Z")
I am using the fingerprint plugin with the concatenate\_all\_fields option to generate a UUID for each document. I got into a situation where the content of my message does not change but since @timestamp is integral part… --- ## [Logstash 5 upgrades require re-installing logstash-output-exec plugin after upgrade, why?](https://discuss.elastic.co/t/logstash-5-upgrades-require-re-installing-logstash-output-exec-plugin-after-upgrade-why/113111)
**Author:** [@nnet](https://discuss.elastic.co/u/nnet)\ **Replies:** 1\ **Last updated:** [December 29, 2017, 6:45am UTC](https://discuss.elastic.co/t/logstash-5-upgrades-require-re-installing-logstash-output-exec-plugin-after-upgrade-why/113111 "2017-12-29T06:45:23Z")
Hi folks, I upgraded ELK stack on Ubuntu Server 16.04 using this as repo: APT-Sources: https://artifacts.elastic.co/packages/5.x/apt stable/main amd64 Packages from 2.x to 5.x and that was largely problem-free except t… --- ## [Logstash output](https://discuss.elastic.co/t/logstash-output/113392)
**Author:** [@anjali](https://discuss.elastic.co/u/anjali)\ **Replies:** 10\ **Last updated:** [December 29, 2017, 6:29am UTC](https://discuss.elastic.co/t/logstash-output/113392 "2017-12-29T06:29:32Z")
Hello, I am new to the ELK stack. I have installed logstash stdout output plugin. Can someone tell me where I can see the output of logstash? (Because I am parsing the message in logstash but it is not showing in Kibana… --- ## [Use ruby filter decode base64 field cannot replace oldfields](https://discuss.elastic.co/t/use-ruby-filter-decode-base64-field-cannot-replace-oldfields/113315)
**Author:** [@yuki\_Tsao](https://discuss.elastic.co/u/yuki_Tsao)\ **Replies:** 1\ **Last updated:** [December 29, 2017, 3:35am UTC](https://discuss.elastic.co/t/use-ruby-filter-decode-base64-field-cannot-replace-oldfields/113315 "2017-12-29T03:35:37Z")
I have a k,v pairs, some of them was base64 encoded. like this "requestMsg" =\> { "userInfo" =\> "eyJ1c2VySWQiOiIxNTIyMjY3NTY5NCIsInR5cGUiOiIxIn0=", "random" =\> "462091", "original… --- ## [Logstash Netflow Module Change Index Pattern Field](https://discuss.elastic.co/t/logstash-netflow-module-change-index-pattern-field/113113)
**Author:** [@Michael\_Tsikerdekis](https://discuss.elastic.co/u/Michael_Tsikerdekis)\ **Replies:** 3\ **Last updated:** [December 29, 2017, 2:09am UTC](https://discuss.elastic.co/t/logstash-netflow-module-change-index-pattern-field/113113 "2017-12-29T02:09:04Z")
I am trying to change the default indexing pattern for logstash's netflow module. Currently fields netflow.dst\_port and netflow.src\_port are set to be string! I have been changing the json files (netflow.json) in this d… --- ## [Logstash 6.1.x not reading entire stdin](https://discuss.elastic.co/t/logstash-6-1-x-not-reading-entire-stdin/113492)
**Author:** [@nixy](https://discuss.elastic.co/u/nixy)\ **Replies:** 2\ **Last updated:** [December 29, 2017, 1:09am UTC](https://discuss.elastic.co/t/logstash-6-1-x-not-reading-entire-stdin/113492 "2017-12-29T01:09:45Z")
Anyone else seeing this behavior: Logstash 6.1.0 and 6.1.1 is not reading entire stdin. Logstash 6.0.x works correctly. Test conditions: Create an input file '5000recs.json' containing newline delimited JSON records l… --- ## [Logstash not aggregating as it should (I think)](https://discuss.elastic.co/t/logstash-not-aggregating-as-it-should-i-think/113509)
**Author:** [@ppalmeida](https://discuss.elastic.co/u/ppalmeida)\ **Replies:** 0\ **Last updated:** [December 28, 2017, 9:21pm UTC](https://discuss.elastic.co/t/logstash-not-aggregating-as-it-should-i-think/113509 "2017-12-28T21:21:30Z")
Hey, there. I am trying to use LogStash to send data do ES and I have encountered a problem I could not handle yet: Consider a table like where the important columns are: proc\_id | title | operations\_id | products\_id … --- ## [Problem with elastic output plugin](https://discuss.elastic.co/t/problem-with-elastic-output-plugin/113003)
**Author:** [@Matias\_Cabre](https://discuss.elastic.co/u/Matias_Cabre)\ **Replies:** 3\ **Last updated:** [December 28, 2017, 8:00pm UTC](https://discuss.elastic.co/t/problem-with-elastic-output-plugin/113003 "2017-12-28T20:00:15Z")
Hi guys, how are you ? I have a problem with logstash and elastic output plugin, I'm sending a file to this logstash conf with json records on it, and i want to put them in elastic, this is my conf input{ std… --- ## [Logstash is failing with response code 403 (index\_closed\_exception)](https://discuss.elastic.co/t/logstash-is-failing-with-response-code-403-index-closed-exception/113231)
**Author:** [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Replies:** 8\ **Last updated:** [December 28, 2017, 3:56pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-response-code-403-index-closed-exception/113231 "2017-12-28T15:56:13Z")
Dear ELK stack specialists i am having a weird behavior with my ELK stack system. The way i set up retention policy is that all the indexes older than 14 days are being closed and all the indexes older than 3 months are … --- ## [Encrypt / secure Elasticsearch's password in logstash.conf file](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549)
**Author:** [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)\ **Replies:** 5\ **Last updated:** [December 28, 2017, 3:12pm UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549 "2017-12-28T15:12:50Z")
I'm using x-pack to secure ELK stack , I don't want to specify plain text "username" and "password" in logstash.conf for elasticsearch output plugin. Is there any way to do that? output { elasticsearch { hosts =\> "ho… --- ## [Need help to parse JSON events](https://discuss.elastic.co/t/need-help-to-parse-json-events/113424)
**Author:** [@siddarth.talupula](https://discuss.elastic.co/u/siddarth.talupula)\ **Replies:** 1\ **Last updated:** [December 28, 2017, 2:23pm UTC](https://discuss.elastic.co/t/need-help-to-parse-json-events/113424 "2017-12-28T14:23:58Z")
Hi All, My application event log contains events in this format: 12/20/2017 11:08:50 AM - ProlexicService - DEBUG - new value added to event array : { "eventEndTime": 1513701199, "eventInfo": { "attackId": "01fbm--1… --- ## [Too many open files. Logstash 6.1](https://discuss.elastic.co/t/too-many-open-files-logstash-6-1/113334)
**Author:** [@kezz](https://discuss.elastic.co/u/kezz)\ **Replies:** 1\ **Last updated:** [December 28, 2017, 10:00am UTC](https://discuss.elastic.co/t/too-many-open-files-logstash-6-1/113334 "2017-12-28T10:00:54Z")
Hey, folks! Please help me solve this problem. Logstash 6.1 Have this in logs: ...... \[2017-12-25T21:23:21,010\]\[WARN \]\[io.netty.channel.DefaultChannelPipeline\] An exceptionCaught() event was fired, and it reached … --- ## [Logstash RabbitMQ SSL](https://discuss.elastic.co/t/logstash-rabbitmq-ssl/113400)
**Author:** [@sedawk](https://discuss.elastic.co/u/sedawk)\ **Replies:** 0\ **Last updated:** [December 28, 2017, 6:42am UTC](https://discuss.elastic.co/t/logstash-rabbitmq-ssl/113400 "2017-12-28T06:42:21Z")
I have installed logstash on 2 nodes to send the logs to RabbitMQ. SSL is configured on RabbitMQ listening 5671 port. I have configured both the logstash to push the logs to rabbitmq server on the 5671 port. This is my … --- ## [Need logstash grok help](https://discuss.elastic.co/t/need-logstash-grok-help/113268)
**Author:** [@subin](https://discuss.elastic.co/u/subin)\ **Replies:** 5\ **Last updated:** [December 27, 2017, 6:46pm UTC](https://discuss.elastic.co/t/need-logstash-grok-help/113268 "2017-12-27T18:46:26Z")
Hi, My pattern works well in grok-debugger, but fails in Logstash's pipeline. I've been trying for hours; no luck. Here are the logs that I'm trying to parse: Nov 10 20:06:05 mx1 postfix/qmgr\[4016\]: D134620D03: from=\ **Author:** [@Arthur\_Silva\_Sens](https://discuss.elastic.co/u/Arthur_Silva_Sens)\ **Replies:** 1\ **Last updated:** [December 27, 2017, 3:55pm UTC](https://discuss.elastic.co/t/help-needed-same-grok-pattern-multiple-matches/113318 "2017-12-27T15:55:57Z") Greetings, I'm having a difficult time to classify some JBOSS logs when it sends me java exceptions. Here is my logstash.config filter { grok { match =\> { "message" =\> "\\.(?\(.)\*Exception):(.|\\r|\\… --- ## [(Need Help) Import data from mysql to elasticsearch using logstash](https://discuss.elastic.co/t/need-help-import-data-from-mysql-to-elasticsearch-using-logstash/113082)
**Author:** [@diooda](https://discuss.elastic.co/u/diooda)\ **Replies:** 3\ **Last updated:** [December 27, 2017, 3:50pm UTC](https://discuss.elastic.co/t/need-help-import-data-from-mysql-to-elasticsearch-using-logstash/113082 "2017-12-27T15:50:37Z")
help me please for Import data from mysql to elasticsearch using logstash my logstash.conf: input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/angga1" jdbc\_user =\> "root" jdbc\_password =\> "" jdb… --- ## [Event is not created for null value records](https://discuss.elastic.co/t/event-is-not-created-for-null-value-records/112423)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 3\ **Last updated:** [December 27, 2017, 2:52pm UTC](https://discuss.elastic.co/t/event-is-not-created-for-null-value-records/112423 "2017-12-27T14:52:14Z")
Hi All I have a json file, which is in this below format, for all the records date2 is always null. But in future this date2 can have the value. Since currently date2 is having null value, because of this date2 event … --- ## [If a single log file has data in different sections and each section is in a different format then how to parse it using logstash](https://discuss.elastic.co/t/if-a-single-log-file-has-data-in-different-sections-and-each-section-is-in-a-different-format-then-how-to-parse-it-using-logstash/113228)
**Author:** [@nandakishore](https://discuss.elastic.co/u/nandakishore)\ **Replies:** 2\ **Last updated:** [December 27, 2017, 2:09pm UTC](https://discuss.elastic.co/t/if-a-single-log-file-has-data-in-different-sections-and-each-section-is-in-a-different-format-then-how-to-parse-it-using-logstash/113228 "2017-12-27T14:09:26Z")
Hi, My log file has different sections. At the beginning it can have a tabular data and then a multiple log lines with format1 and then multiple lines with format 2 etc.. How can I split the log file in to different se… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=848) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=850)