# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=858 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 859 --- ## [UDP Input plugin Error: TypeError: can't convert nil into String](https://discuss.elastic.co/t/udp-input-plugin-error-typeerror-cant-convert-nil-into-string/110565)
**Author:** [@akirafei](https://discuss.elastic.co/u/akirafei)\ **Replies:** 6\ **Last updated:** [December 12, 2017, 7:52pm UTC](https://discuss.elastic.co/t/udp-input-plugin-error-typeerror-cant-convert-nil-into-string/110565 "2017-12-12T19:52:45Z")
Once we start sending 200 more messages to UPD input during perf testing, I start seeing below errors and packets get lost. \[2017-12-06T18:46:04,519\]\[ERROR\]\[l.i.udp \] Exception in inputworker {"excepti… --- ## [Logstash 5.4 elasticsearch input size not working](https://discuss.elastic.co/t/logstash-5-4-elasticsearch-input-size-not-working/111422)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 0\ **Last updated:** [December 12, 2017, 7:43pm UTC](https://discuss.elastic.co/t/logstash-5-4-elasticsearch-input-size-not-working/111422 "2017-12-12T19:43:20Z")
The below always returns all docs. We want to limit the return set to 2: input { Read all documents from Elasticsearch matching the given query elasticsearch { hosts =\> "xxx.xxx.xxx.xxx:9202" index =\> "rrdb\_matter\_1… --- ## [Create directories according to field in s3 bucket](https://discuss.elastic.co/t/create-directories-according-to-field-in-s3-bucket/111173)
**Author:** [@Ferdous\_Shibly](https://discuss.elastic.co/u/Ferdous_Shibly)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 7:31pm UTC](https://discuss.elastic.co/t/create-directories-according-to-field-in-s3-bucket/111173 "2017-12-12T19:31:15Z")
Hi, We are using logstash to route logs to different places like different elasticsearch clusters. Now we want to store logs in s3 bucket as well. We are using logstash-output-s3. logstash-output-s3 plugin could store a… --- ## [Redis input plugin -proxy and ssl](https://discuss.elastic.co/t/redis-input-plugin-proxy-and-ssl/111195)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 7:02pm UTC](https://discuss.elastic.co/t/redis-input-plugin-proxy-and-ssl/111195 "2017-12-12T19:02:14Z")
I could successfully use redis with socks proxy and ssl in beats. But, I'm not able to read from redis using redis input plugin ofr logstash. beat has settings for proxy and ssl as "proxy\_url" and "ssl.enabled" to send … --- ## [Why '\[field\] in \[ "value" \]' is not working as expected?](https://discuss.elastic.co/t/why-field-in-value-is-not-working-as-expected/111411)
**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\ **Replies:** 0\ **Last updated:** [December 12, 2017, 6:44pm UTC](https://discuss.elastic.co/t/why-field-in-value-is-not-working-as-expected/111411 "2017-12-12T18:44:53Z")
Hello. I have a field and I want to compare its value agains the list of another values, but this comparison does not work: if \[field\] in \[ "value" \] But this works: if \[field\] in \[ "randomxyz", "value" \] Why there … --- ## [Geting multiple IP address into geoip field (From,To)](https://discuss.elastic.co/t/geting-multiple-ip-address-into-geoip-field-from-to/111298)
**Author:** [@Ninoslav](https://discuss.elastic.co/u/Ninoslav)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 4:04pm UTC](https://discuss.elastic.co/t/geting-multiple-ip-address-into-geoip-field-from-to/111298 "2017-12-12T16:04:06Z")
Hello, I\`am having a situation, where i want to monitor Cisco routers, and i want to get both From and To IP address, into my geoIP field. I havea line in my config file that looks something like geoip { source =\> "Cl… --- ## [Logstash / Elasticsearch Double Values](https://discuss.elastic.co/t/logstash-elasticsearch-double-values/111326)
**Author:** [@MaikLinnemann](https://discuss.elastic.co/u/MaikLinnemann)\ **Replies:** 4\ **Last updated:** [December 12, 2017, 3:38pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-double-values/111326 "2017-12-12T15:38:06Z")
Dear all, i have an issue with logstash that i try to solve since a while. My issue is that the values for the output of "PROBLEMSITE" is always double. Here is an JSON example: "\_source": { "request": \[ "/… --- ## [Problem with tags field in Elasticsearch](https://discuss.elastic.co/t/problem-with-tags-field-in-elasticsearch/111323)
**Author:** [@kabali12345](https://discuss.elastic.co/u/kabali12345)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 3:28pm UTC](https://discuss.elastic.co/t/problem-with-tags-field-in-elasticsearch/111323 "2017-12-12T15:28:47Z")
Hi all, here is the issue when i take input from a file and enriching with jdbc streaming filter the below conf i used input { file { path =\> "/home/sgpl/ss" type =\> "end" sincedb\_path =\> "/tmp/titanickk" st… --- ## [Dns Lookup save only when find hostname](https://discuss.elastic.co/t/dns-lookup-save-only-when-find-hostname/111368)
**Author:** [@SchwiftyDoc](https://discuss.elastic.co/u/SchwiftyDoc)\ **Replies:** 0\ **Last updated:** [December 12, 2017, 2:59pm UTC](https://discuss.elastic.co/t/dns-lookup-save-only-when-find-hostname/111368 "2017-12-12T14:59:12Z")
Hello i'm trying to get hostname from the netflow i'm working on. From now on i have this code filter { # Don't save what concern the host #if "\*.\*.\*.\*" in \["%{\[source\]\[ip\]}", "%{\[dest\]\[ip\]}"\] { … --- ## [Ingest events from ArcSight Logger to Elasticsearch using Forwarder](https://discuss.elastic.co/t/ingest-events-from-arcsight-logger-to-elasticsearch-using-forwarder/106646)
**Author:** [@undelete](https://discuss.elastic.co/u/undelete)\ **Replies:** 18\ **Last updated:** [December 12, 2017, 2:54pm UTC](https://discuss.elastic.co/t/ingest-events-from-arcsight-logger-to-elasticsearch-using-forwarder/106646 "2017-12-12T14:54:09Z")
I am using the ArcSight module to receive events from my SmartConnectors. However I have an ArcSight Logger filled with events and I would like to use the Forwarding capabilities in ArcSight Logger to forward events to E… --- ## [One to Many](https://discuss.elastic.co/t/one-to-many/111363)
**Author:** [@rnicholls](https://discuss.elastic.co/u/rnicholls)\ **Replies:** 0\ **Last updated:** [December 12, 2017, 2:44pm UTC](https://discuss.elastic.co/t/one-to-many/111363 "2017-12-12T14:44:35Z")
Hello, I am trying to figure out how to do a one to many relationships. I am using JDBC and I have tried to do it via aggregate but can't figure it out. All I am trying to do is. { id: "1" title: "Batman v Superman" … --- ## [Initializing module - infinite loop error](https://discuss.elastic.co/t/initializing-module-infinite-loop-error/111068)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 1:59pm UTC](https://discuss.elastic.co/t/initializing-module-infinite-loop-error/111068 "2017-12-12T13:59:48Z")
Hi, we've installed new version of logstash 6.0.1 on Centos. It was pure installation of operational system and elk too. But when we run logstash, it says this infinite loop: \[2017-12-11T11:13:08,944\]\[INFO \]\[logstash.mo… --- ## [Enterprise Log collection Architecture with Elastic](https://discuss.elastic.co/t/enterprise-log-collection-architecture-with-elastic/107599)
**Author:** [@eamonn](https://discuss.elastic.co/u/eamonn)\ **Replies:** 20\ **Last updated:** [December 12, 2017, 1:36pm UTC](https://discuss.elastic.co/t/enterprise-log-collection-architecture-with-elastic/107599 "2017-12-12T13:36:22Z")
I am tasked with designing a log collection architecture which involves collecting application and infrastructure logs from a number of Linux and windows severs and databases which are virtualization clustered and load b… --- ## [Issue with Kafka input with Logstash](https://discuss.elastic.co/t/issue-with-kafka-input-with-logstash/111327)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 12:57pm UTC](https://discuss.elastic.co/t/issue-with-kafka-input-with-logstash/111327 "2017-12-12T12:57:31Z")
Hi All, I am using Kafka as input for Logstash , with below configuration to consume topics input { kafka { zk\_connect =\> {"localhost:2181"} topic\_id =\> {"ITSB"} } } but i am not able to start Logstash , getting … --- ## [Saving logs in different logstash index](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131)
**Author:** [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)\ **Replies:** 5\ **Last updated:** [December 12, 2017, 12:34pm UTC](https://discuss.elastic.co/t/saving-logs-in-different-logstash-index/110131 "2017-12-12T12:34:02Z")
Hi team, I have question regarding saving logs in different logstash files based on pattern matching. for example- filter{ grok{ match =\> \[ "message","pattern1", "message","pattern2" \] } } output{ //how to sa… --- ## [Multi nested documents in logstash aggregation](https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597)
**Author:** [@ahmadhattab](https://discuss.elastic.co/u/ahmadhattab)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 11:34am UTC](https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597 "2017-12-12T11:34:20Z")
Hello, I have 3 tables: users posts comments I made a left join query to get users then posts then comments like this: SELECT users.id as user\_id, users.name as user\_name, posts.id as post\_id, posts.title as post\_ti… --- ## [Logastsh6.0 not picking config files from conf.d](https://discuss.elastic.co/t/logastsh6-0-not-picking-config-files-from-conf-d/111243)
**Author:** [@sesaravanan](https://discuss.elastic.co/u/sesaravanan)\ **Replies:** 4\ **Last updated:** [December 12, 2017, 11:15am UTC](https://discuss.elastic.co/t/logastsh6-0-not-picking-config-files-from-conf-d/111243 "2017-12-12T11:15:16Z")
Hi, Logstash 6.0 not picking config files from conf.d directory automatically, instead if i run logstash with -f switch from commandline it works. Thanks, Saravanan --- ## [How to get Beat client ip in Logstash](https://discuss.elastic.co/t/how-to-get-beat-client-ip-in-logstash/111264)
**Author:** [@saravanan\_kutty](https://discuss.elastic.co/u/saravanan_kutty)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 11:10am UTC](https://discuss.elastic.co/t/how-to-get-beat-client-ip-in-logstash/111264 "2017-12-12T11:10:51Z")
Hi, I am new to ELK and trying to get the IP of the File Beat Client in Kibana through Logstash. tried various option which is available in the forum but unable to find the workable solution. Using ELK 5.6.4. Any help … --- ## [Email body is it not evaluating %{message}](https://discuss.elastic.co/t/email-body-is-it-not-evaluating-message/111180)
**Author:** [@psosa](https://discuss.elastic.co/u/psosa)\ **Replies:** 6\ **Last updated:** [December 12, 2017, 11:10am UTC](https://discuss.elastic.co/t/email-body-is-it-not-evaluating-message/111180 "2017-12-12T11:10:38Z")
input { jdbc { ... ... statement =\> "SELECT 70 as value" } } output { stdout { codec =\> rubydebug } email { authentication =\> 'login' from =\> 'whatever@xxx.com' domain =\> 'xxx.com' … --- ## [Elasticsearch Input Plugin for Logstash 6.0.0 - Issue indexing data](https://discuss.elastic.co/t/elasticsearch-input-plugin-for-logstash-6-0-0-issue-indexing-data/110054)
**Author:** [@PixelatedFigure](https://discuss.elastic.co/u/PixelatedFigure)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-for-logstash-6-0-0-issue-indexing-data/110054 "2017-12-12T10:53:15Z")
This issue regards ES Input Plugin for Logstash. I am using Windows 10 and the new Logstash 6.0.0 version. I'm trying to run 2 pipelines -via the new pipeline.yml configuration- where the first one grabs the data from … --- ## [Selecting from single column in database table without column name](https://discuss.elastic.co/t/selecting-from-single-column-in-database-table-without-column-name/111121)
**Author:** [@johnjingle](https://discuss.elastic.co/u/johnjingle)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 10:46am UTC](https://discuss.elastic.co/t/selecting-from-single-column-in-database-table-without-column-name/111121 "2017-12-12T10:46:20Z")
I am a newbie. Using Logstash to load data from a database.. The column jasondata contains a json string. "SELECT jsondata FROM \[test\].\[dbo\].\[employees\]" and in ElasticSearch I get jsondata: {"1":223,"firstName":"Sta… --- ## [Documentation for the raw field](https://discuss.elastic.co/t/documentation-for-the-raw-field/111137)
**Author:** [@Paul\_D\_Ambra](https://discuss.elastic.co/u/Paul_D_Ambra)\ **Replies:** 5\ **Last updated:** [December 12, 2017, 9:34am UTC](https://discuss.elastic.co/t/documentation-for-the-raw-field/111137 "2017-12-12T09:34:10Z")
I've found some code where applications are purposefully logging JSON instead of a message and inside that JSON logging a string into a field called raw. My understanding is that raw is normally autocreated and we're li… --- ## [Extract IP from message into a separate field](https://discuss.elastic.co/t/extract-ip-from-message-into-a-separate-field/111193)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 8:35am UTC](https://discuss.elastic.co/t/extract-ip-from-message-into-a-separate-field/111193 "2017-12-12T08:35:54Z")
Hey all, I've got syslog setup on my router and I've been wanting to extract the IPV4 field from the message into a new field This is what one type of message looks like 36\> 2017-12-11 11:46:3 0 System Detected UDP po… --- ## [Logstash on Production(Windows Server 2012)](https://discuss.elastic.co/t/logstash-on-production-windows-server-2012/111255)
**Author:** [@ankitchourasia123](https://discuss.elastic.co/u/ankitchourasia123)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 8:19am UTC](https://discuss.elastic.co/t/logstash-on-production-windows-server-2012/111255 "2017-12-12T08:19:29Z")
I understand, we can configure Logstash on Windows 7 or Windows 10 but can I run Logstash and its related plugins like Filebeat etc., on Windows server 2012 on Production efficiently? --- ## [Remove part of field name in Logstash](https://discuss.elastic.co/t/remove-part-of-field-name-in-logstash/111062)
**Author:** [@gasmi](https://discuss.elastic.co/u/gasmi)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 6:32am UTC](https://discuss.elastic.co/t/remove-part-of-field-name-in-logstash/111062 "2017-12-12T06:32:06Z")
I am using Logstash 6.0.0 I am receiving metrics with different application Ids. How can I delete the application Id in the field name? application\_1512057801087\_0235.driver.BlockManager.memory.maxMem\_MB =\> driver.Bl… --- ## [Initctl start logstash doesnt open the port](https://discuss.elastic.co/t/initctl-start-logstash-doesnt-open-the-port/111093)
**Author:** [@lvrodr](https://discuss.elastic.co/u/lvrodr)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 6:23am UTC](https://discuss.elastic.co/t/initctl-start-logstash-doesnt-open-the-port/111093 "2017-12-12T06:23:34Z")
Hi, I installed logstash 6.0 on Ubuntu 12.04 but it only starts on port 5000 if I start it by the script (bin/logstash -f), if I start with INITCTL the port 500 doesn't open, is there any way to fix this or the right way… --- ## [Logstash 5.3.\* could not start due to Log4j](https://discuss.elastic.co/t/logstash-5-3-could-not-start-due-to-log4j/110502)
**Author:** [@HelloUniverse](https://discuss.elastic.co/u/HelloUniverse)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 5:54am UTC](https://discuss.elastic.co/t/logstash-5-3-could-not-start-due-to-log4j/110502 "2017-12-12T05:54:07Z")
Hi There, JDK 1.8.66, Logstash 5.3.1 So far we encountered a weired problem. The error information is as the following: LoadError: load error: logstash/environment -- java.lang.IllegalAccessError: class org.apache.lo… --- ## [Netflow codec UDP input worker silently crashes](https://discuss.elastic.co/t/netflow-codec-udp-input-worker-silently-crashes/109798)
**Author:** [@jasonkeller](https://discuss.elastic.co/u/jasonkeller)\ **Replies:** 5\ **Last updated:** [December 11, 2017, 7:54pm UTC](https://discuss.elastic.co/t/netflow-codec-udp-input-worker-silently-crashes/109798 "2017-12-11T19:54:51Z")
On... Red Hat Enterprise Linux Server 7.4 (Maipo) logstash 5.6.4-1 logstash-codec-netflow-3.8.1 openjdk-1.8.0\_151-b12 lscpu Architecture: x86\_64 CPU op-mode(s): 32-bit, 64-bit Byte Order: … --- ## [Logstash Input Plugin 4XX codes](https://discuss.elastic.co/t/logstash-input-plugin-4xx-codes/110712)
**Author:** [@Jathin](https://discuss.elastic.co/u/Jathin)\ **Replies:** 1\ **Last updated:** [December 11, 2017, 7:09pm UTC](https://discuss.elastic.co/t/logstash-input-plugin-4xx-codes/110712 "2017-12-11T19:09:10Z")
logstash-http-input plugin is configured with basic auth. My ELB is reporting 4XX errors. Is there any way i can get access logs. just wanted to get client ip and the response codes when http-input-plugin is not able to … --- ## [Logstash-input-azureblob](https://discuss.elastic.co/t/logstash-input-azureblob/111156)
**Author:** [@Reddy](https://discuss.elastic.co/u/Reddy)\ **Replies:** 0\ **Last updated:** [December 11, 2017, 6:10pm UTC](https://discuss.elastic.co/t/logstash-input-azureblob/111156 "2017-12-11T18:10:33Z")
Unable to get the logs either to File or Elasticsearch using logstash-input-azureblob plugin for logstash. Used this config, input { azureblob { storage\_account\_name =\> "storage\_account\_name" storage\_access\_key =\>… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=857) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=859)