# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=889 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 890 --- ## [Weekly indices with name as starting day of the week](https://discuss.elastic.co/t/weekly-indices-with-name-as-starting-day-of-the-week/104307)
**Author:** [@Manikanth\_Reddy](https://discuss.elastic.co/u/Manikanth_Reddy)\ **Replies:** 10\ **Last updated:** [October 19, 2017, 6:34pm UTC](https://discuss.elastic.co/t/weekly-indices-with-name-as-starting-day-of-the-week/104307 "2017-10-19T18:34:33Z")
Hi, As of now, we are using daily indices and are trying to create weekly indices going forward. I have tried configuring indexprefix-%{+xxxx.ww} but it is giving indices by week number out of year. I have been trying … --- ## [XML format on rows](https://discuss.elastic.co/t/xml-format-on-rows/104269)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 7\ **Last updated:** [October 19, 2017, 6:34pm UTC](https://discuss.elastic.co/t/xml-format-on-rows/104269 "2017-10-19T18:34:21Z")
Hi, I have an Microsoft NPS server that ouputs monthly logfiles with XML formatted rows that looks like this: \\10/17/2017 15:57:24.465\\NPSSERVER01\ **Author:** [@abudaev](https://discuss.elastic.co/u/abudaev)\ **Replies:** 3\ **Last updated:** [October 19, 2017, 5:23pm UTC](https://discuss.elastic.co/t/parse-json-array-to-flat-object/104544 "2017-10-19T17:23:16Z") Hello. I have a log string like this: 2017-08-18 14:26:07.757 \[pool-18-thread-4\] INFO r.s.c.i.s.w.WebSocketServerSessionHandler - SEND \[63426612-2bbd-4e34-97c2-6bcc374fd654\] OnItemAdded: {"item": {"id": "3ca48ea5-4dd2… --- ## [Filter WinEventLog Type by User.Name](https://discuss.elastic.co/t/filter-wineventlog-type-by-user-name/104591)
**Author:** [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)\ **Replies:** 1\ **Last updated:** [October 19, 2017, 4:37pm UTC](https://discuss.elastic.co/t/filter-wineventlog-type-by-user-name/104591 "2017-10-19T16:37:38Z")
The question is specific to user.name but it also applies to any "multi-part" field like event\_data.TargetUserName, etc which all have the same issue in my experience. In the following config example, logs that match bo… --- ## [Help me pls, I using logstash 5.5.0 input JDBC sybase but field type datetime got convert to UTC](https://discuss.elastic.co/t/help-me-pls-i-using-logstash-5-5-0-input-jdbc-sybase-but-field-type-datetime-got-convert-to-utc/104401)
**Author:** [@Prapat\_Polchan](https://discuss.elastic.co/u/Prapat_Polchan)\ **Replies:** 5\ **Last updated:** [October 19, 2017, 4:37pm UTC](https://discuss.elastic.co/t/help-me-pls-i-using-logstash-5-5-0-input-jdbc-sybase-but-field-type-datetime-got-convert-to-utc/104401 "2017-10-19T16:37:00Z")
Help me pls, I using logstash 5.5.0 input JDBC sybase but field type datetime got convert to UTC Example my data field Default on database pay\_date =\> "2017-10-18 11:00:00" But pass to Elasticsearch pay\_date =\>"201… --- ## [Set @timestamp to integer](https://discuss.elastic.co/t/set-timestamp-to-integer/104585)
**Author:** [@f1ccb489d33b33a0f12a](https://discuss.elastic.co/u/f1ccb489d33b33a0f12a)\ **Replies:** 0\ **Last updated:** [October 19, 2017, 3:57pm UTC](https://discuss.elastic.co/t/set-timestamp-to-integer/104585 "2017-10-19T15:57:54Z")
hello all, in my project, there is no meaning for time. only order of arrival. i want to change @timestamp to be an integer starting from 100000 and goes on. is there a way to do it? i tried using the date filter lik… --- ## [Change @timestamp to be an integer](https://discuss.elastic.co/t/change-timestamp-to-be-an-integer/104584)
**Author:** [@f1ccb489d33b33a0f12a](https://discuss.elastic.co/u/f1ccb489d33b33a0f12a)\ **Replies:** 0\ **Last updated:** [October 19, 2017, 3:54pm UTC](https://discuss.elastic.co/t/change-timestamp-to-be-an-integer/104584 "2017-10-19T15:54:29Z")
hello every one, i'm trying to use the logstash config file to set the timestamp to be an integer in an order. like, the first report to get in will 1, and the second will be 2 and so on. in my project there is no mea… --- ## [Logstash 5.6.3 setup with Filebeat and Kibana on CentOS 7](https://discuss.elastic.co/t/logstash-5-6-3-setup-with-filebeat-and-kibana-on-centos-7/104568)
**Author:** [@Jens\_van\_der\_Wateren](https://discuss.elastic.co/u/Jens_van_der_Wateren)\ **Replies:** 0\ **Last updated:** [October 19, 2017, 1:58pm UTC](https://discuss.elastic.co/t/logstash-5-6-3-setup-with-filebeat-and-kibana-on-centos-7/104568 "2017-10-19T13:58:04Z")
I've been trying to experiment with Elasticsearch and the Elastic Cloud because I might want to use it for the company I currently work for. I have a 2 week trial, but I'm afraid I've not yet come very far because I cann… --- ## [Logstash instance scaling](https://discuss.elastic.co/t/logstash-instance-scaling/103497)
**Author:** [@Ondro\_Tadanai](https://discuss.elastic.co/u/Ondro_Tadanai)\ **Replies:** 4\ **Last updated:** [October 19, 2017, 10:00am UTC](https://discuss.elastic.co/t/logstash-instance-scaling/103497 "2017-10-19T10:00:25Z")
Hi, I am using logstash with logstash-twitter-input to scrape some tweets in real-time. How to configure logstash scaling, if I want to run 2 instances (for example) how to effectively configure logstash instances to c… --- ## [Bug : input type logstash aws](https://discuss.elastic.co/t/bug-input-type-logstash-aws/104516)
**Author:** [@saif](https://discuss.elastic.co/u/saif)\ **Replies:** 0\ **Last updated:** [October 19, 2017, 8:19am UTC](https://discuss.elastic.co/t/bug-input-type-logstash-aws/104516 "2017-10-19T08:19:24Z")
i use logstash in AWS linux NAME="Amazon Linux AMI" VERSION="2017.09" ID="amzn" ID\_LIKE="rhel fedora" VERSION\_ID="2017.09" PRETTY\_NAME="Amazon Linux AMI 2017.09" ANSI\_COLOR="0;33" CPE\_NAME="cpe:/o:amazon:linux:20… --- ## [The unusual syslog from cisco](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470)
**Author:** [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Replies:** 9\ **Last updated:** [October 19, 2017, 7:54am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470 "2017-10-19T07:54:06Z")
We have some cisco devices , all of them have the same syslog configuration. The normal format should like: \<187\>11640: PH18L1\_CS29SW01: Oct 19 09:11:45.797 GMT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, chang… --- ## [Logstash conf file execution slow and exit automatically](https://discuss.elastic.co/t/logstash-conf-file-execution-slow-and-exit-automatically/104499)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 0\ **Last updated:** [October 19, 2017, 6:47am UTC](https://discuss.elastic.co/t/logstash-conf-file-execution-slow-and-exit-automatically/104499 "2017-10-19T06:47:21Z")
For extract the logs I have write a logstash conf file and executed. This script was run more than 5 months without any issue, Since today morning, the script suddenly stop the executing the logs and stopped. Then I hav… --- ## [Translate Plugin in Logstash not working](https://discuss.elastic.co/t/translate-plugin-in-logstash-not-working/104186)
**Author:** [@sreejiths](https://discuss.elastic.co/u/sreejiths)\ **Replies:** 9\ **Last updated:** [October 19, 2017, 6:33am UTC](https://discuss.elastic.co/t/translate-plugin-in-logstash-not-working/104186 "2017-10-19T06:33:09Z")
I am using Logstash V5.2 . Using ELK for device syslog Analytics . I have requirement in which if a source of device (Ip address) sending syslog matches one column of the csv file , i need to add a field which will be th… --- ## [How to deal with double type fields?](https://discuss.elastic.co/t/how-to-deal-with-double-type-fields/104491)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [October 19, 2017, 6:08am UTC](https://discuss.elastic.co/t/how-to-deal-with-double-type-fields/104491 "2017-10-19T06:08:10Z")
Hi, I'm still trying to get my Fortigate logs to parse correctly. I've ran into a new problem: double type fields. I use the type field to identify my logs but the Fortigate logs itself also have a type field. Once I t… --- ## [Logstash filter for IP addresses](https://discuss.elastic.co/t/logstash-filter-for-ip-addresses/104450)
**Author:** [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Replies:** 0\ **Last updated:** [October 18, 2017, 7:29pm UTC](https://discuss.elastic.co/t/logstash-filter-for-ip-addresses/104450 "2017-10-18T19:29:42Z")
I have absolutely no idea how to accomplish what I want to accomplish. I have Elasticsearch, Kibana and Logstash configured (all version 5.6.2) and running on Windows 2012 R2. I have my grok filter that parses the data l… --- ## [Grok pattern matching from MAC access](https://discuss.elastic.co/t/grok-pattern-matching-from-mac-access/104387)
**Author:** [@mussa572](https://discuss.elastic.co/u/mussa572)\ **Replies:** 1\ **Last updated:** [October 18, 2017, 8:29pm UTC](https://discuss.elastic.co/t/grok-pattern-matching-from-mac-access/104387 "2017-10-18T20:29:12Z")
Hi wondering if some one can help . We are ingesting some of the Linux Inventory in Elastic Search . One of the field is MAC address (00:50:56:a9:2c:51) . We are looking for the if condition where if 4 charter of MAC… --- ## [Grok filter not filtering data](https://discuss.elastic.co/t/grok-filter-not-filtering-data/104442)
**Author:** [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Replies:** 4\ **Last updated:** [October 18, 2017, 6:21pm UTC](https://discuss.elastic.co/t/grok-filter-not-filtering-data/104442 "2017-10-18T18:21:47Z")
I have Elasticsearch, Logstash and Kibana all versions 5.6.2 configured and running on Windows 2012 R2. Some sample data I am trying to parse is: (filtered for sensitive info) 2017-09-18 00:00:01 Local4.Debug 00.00.00.0… --- ## [Recommended inflight events max exceeded still persists after increasing batch and heap](https://discuss.elastic.co/t/recommended-inflight-events-max-exceeded-still-persists-after-increasing-batch-and-heap/104434)
**Author:** [@mbitzos](https://discuss.elastic.co/u/mbitzos)\ **Replies:** 1\ **Last updated:** [October 18, 2017, 6:16pm UTC](https://discuss.elastic.co/t/recommended-inflight-events-max-exceeded-still-persists-after-increasing-batch-and-heap/104434 "2017-10-18T18:16:22Z")
I have a 4 node elastic search system running with an instance of logstash pointing to all four instances. I have on average about 600-700 packets of UDP/TCP info being sent through logstash a second. My problem is that… --- ## [Logstash-\* unable to fetch mapping in kibana](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593)
**Author:** [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Replies:** 11\ **Last updated:** [October 18, 2017, 4:47pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593 "2017-10-18T16:47:10Z")
I have Logstash Kibana and Elasticsearch (all version 5.6.2) configured and running on Windows Server 2012 R2, running through a remote desktop connection. I am working on my logstash config file to read data from a .txt… --- ## [Superscript text in data](https://discuss.elastic.co/t/superscript-text-in-data/104303)
**Author:** [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\ **Replies:** 4\ **Last updated:** [October 18, 2017, 4:31pm UTC](https://discuss.elastic.co/t/superscript-text-in-data/104303 "2017-10-18T16:31:19Z")
Hi, I was trying to parse data to Elasticsearch using Logstash and got the following error message: Received an event that has a different character encoding than you configured. {:text=\>"H\\\\tC\\\\tFCE5C9C1-CF1F-4593-9C2… --- ## [Get the input csv file path or filename in email](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929)
**Author:** [@surajbs](https://discuss.elastic.co/u/surajbs)\ **Replies:** 5\ **Last updated:** [October 18, 2017, 3:28pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929 "2017-10-18T15:28:44Z")
Hi, How can we get the input csv file path or filename in email. Below is my config for the input and output: input { file { path =\> "path to file/\*.csv" type =\> "csv" start\_position =\> beginning } file { path … --- ## [(FIXED) Multiline codec behaves differently in 5.x and 6.x](https://discuss.elastic.co/t/fixed-multiline-codec-behaves-differently-in-5-x-and-6-x/103445)
**Author:** [@Andy0708](https://discuss.elastic.co/u/Andy0708)\ **Replies:** 0\ **Last updated:** [October 10, 2017, 9:58pm UTC](https://discuss.elastic.co/t/fixed-multiline-codec-behaves-differently-in-5-x-and-6-x/103445 "2017-10-10T21:58:37Z")
NOTE: I managed to figure out the problem, and it had nothing to do with Logstash. It was a problem with my text editor and how it saves files, which caused Logstash to process the same lines multiple times. In my case I… --- ## [Logstash 6 Failes on start](https://discuss.elastic.co/t/logstash-6-failes-on-start/104417)
**Author:** [@lkofman](https://discuss.elastic.co/u/lkofman)\ **Replies:** 0\ **Last updated:** [October 18, 2017, 2:53pm UTC](https://discuss.elastic.co/t/logstash-6-failes-on-start/104417 "2017-10-18T14:53:08Z")
When I start Logstash 6 from cmd -Installed on Windows 7 - logstash -e --modules : it failes on creation pipeline creation Sending Logstash's logs to C:/DoLense/logstash/logs which is now configured via log4j2.proper… --- ## [How to invoke python script from elasticsearc output plugin](https://discuss.elastic.co/t/how-to-invoke-python-script-from-elasticsearc-output-plugin/104408)
**Author:** [@Lefteris\_Karamoulas](https://discuss.elastic.co/u/Lefteris_Karamoulas)\ **Replies:** 0\ **Last updated:** [October 18, 2017, 2:08pm UTC](https://discuss.elastic.co/t/how-to-invoke-python-script-from-elasticsearc-output-plugin/104408 "2017-10-18T14:08:32Z")
Hello, At the moment i have logstash and elasticsearch. My logstash uses as input the twitter input plug in and as output i have the elasticsearch plugin. My goal is to invoke a python script before the data is stored … --- ## [Multiple filebeat to logstash](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251)
**Author:** [@MLdz](https://discuss.elastic.co/u/MLdz)\ **Replies:** 4\ **Last updated:** [October 18, 2017, 12:36pm UTC](https://discuss.elastic.co/t/multiple-filebeat-to-logstash/104251 "2017-10-18T12:36:26Z")
Hello, i want to connect two filebeat (which are on two differents remote machine) to Logstash. i did the configuration on the filebeat.yml with the host of the ELK server. The problem: in Kibana , i dont see the log … --- ## [Logstash start/killed](https://discuss.elastic.co/t/logstash-start-killed/104225)
**Author:** [@Mayotte](https://discuss.elastic.co/u/Mayotte)\ **Replies:** 1\ **Last updated:** [October 18, 2017, 10:17am UTC](https://discuss.elastic.co/t/logstash-start-killed/104225 "2017-10-18T10:17:52Z")
Hello, Logstash stop to work. It not possible now to start or stop. And the initctl status logstash command show : logstash start/killed, process 3627 But not PID, impossible to start/restart/stop Logstash version 5… --- ## [Not able to parse the Error message part in sitecore logs](https://discuss.elastic.co/t/not-able-to-parse-the-error-message-part-in-sitecore-logs/104363)
**Author:** [@annu](https://discuss.elastic.co/u/annu)\ **Replies:** 0\ **Last updated:** [October 18, 2017, 9:51am UTC](https://discuss.elastic.co/t/not-able-to-parse-the-error-message-part-in-sitecore-logs/104363 "2017-10-18T09:51:11Z")
Hi below given is one of the logs: 6220 04:22:28 ERROR Error in RedirectProcessor Exception: System.Threading.ThreadAbortException Message: Thread was being aborted. Source: YY.yyy.yyyyyy at YY.yyyyy.Yyyyyy.zzz.Red… --- ## [Filter on bucket metric](https://discuss.elastic.co/t/filter-on-bucket-metric/103891)
**Author:** [@saramali](https://discuss.elastic.co/u/saramali)\ **Replies:** 3\ **Last updated:** [October 18, 2017, 8:03am UTC](https://discuss.elastic.co/t/filter-on-bucket-metric/103891 "2017-10-18T08:03:03Z")
I want to filter the results of a count metric. Suppose I want to show only the documents whose count is greater than x or less than x or equal. --- ## [Improving capacity to handle high netflow rates](https://discuss.elastic.co/t/improving-capacity-to-handle-high-netflow-rates/104151)
**Author:** [@djluko](https://discuss.elastic.co/u/djluko)\ **Replies:** 2\ **Last updated:** [October 18, 2017, 6:58am UTC](https://discuss.elastic.co/t/improving-capacity-to-handle-high-netflow-rates/104151 "2017-10-18T06:58:59Z")
I'm trying to improve the performance of Logstash when ingesting about 22,500 Netflow records/sec. I have read the general performance tuning tips here Is there any way to turn off the geoip plugin? Of the 22,500 flow… --- ## [Message not proper showing in elastic after index](https://discuss.elastic.co/t/message-not-proper-showing-in-elastic-after-index/104329)
**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\ **Replies:** 2\ **Last updated:** [October 18, 2017, 6:41am UTC](https://discuss.elastic.co/t/message-not-proper-showing-in-elastic-after-index/104329 "2017-10-18T06:41:37Z")
I transfer data from mysql to kafka using logstash and from kafak to elastic....result is not showing properly.... my conf files are given below: consumer conf file \[consumer\] \[resultshow\] [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=888) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=890)