# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=896 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 897 --- ## [How to use double quotes in logstash exec output](https://discuss.elastic.co/t/how-to-use-double-quotes-in-logstash-exec-output/103174)
**Author:** [@raja\_gopal](https://discuss.elastic.co/u/raja_gopal)\ **Replies:** 0\ **Last updated:** [October 9, 2017, 5:45am UTC](https://discuss.elastic.co/t/how-to-use-double-quotes-in-logstash-exec-output/103174 "2017-10-09T05:45:12Z")
I actually want to use bulk delete operations with logstash exec output but how do i place my command as a string inside the config. My command looks like this command =\> "curl --user es:xxxx -XPOST 'xx.xx.xx.xx:9200/\_b… --- ## [JDBC MySql SQL\_MODE](https://discuss.elastic.co/t/jdbc-mysql-sql-mode/102496)
**Author:** [@sebestenyb](https://discuss.elastic.co/u/sebestenyb)\ **Replies:** 2\ **Last updated:** [October 8, 2017, 10:16pm UTC](https://discuss.elastic.co/t/jdbc-mysql-sql-mode/102496 "2017-10-08T22:16:26Z")
Hello, I'm trying to set sql\_mode for the logstash jdbc connection as per below, but get an error input { jdbc { clean\_run =\> true jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/db?sessionVa… --- ## [Choosing the right plugin](https://discuss.elastic.co/t/choosing-the-right-plugin/103151)
**Author:** [@yoavsradware](https://discuss.elastic.co/u/yoavsradware)\ **Replies:** 0\ **Last updated:** [October 8, 2017, 10:51am UTC](https://discuss.elastic.co/t/choosing-the-right-plugin/103151 "2017-10-08T10:51:24Z")
Hi all I am reserching for the right input plugin for my system , what i need in the end of the day is plugin which support scheduled rest client calls support SSL and ssl.verification\_mode: none support !!! changing … --- ## [Parsing IIS log - remove part of string](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142)
**Author:** [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\ **Replies:** 3\ **Last updated:** [October 8, 2017, 9:21am UTC](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142 "2017-10-08T09:21:16Z")
Hi, I have IIS log, example : 2017-10-01 08:29:30 10.70.4.52 GET /Lists/NewsFeed/AllItems.aspx AjaxDelta=1 80 0#.w|mad\\sp3\_dev 10.70.4.52 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.2;+WOW64;+Trident/6.0;+.NET4.0E;… --- ## [Fetch data from oracle database using logstash](https://discuss.elastic.co/t/fetch-data-from-oracle-database-using-logstash/103134)
**Author:** [@Sumit\_Gupta1](https://discuss.elastic.co/u/Sumit_Gupta1)\ **Replies:** 1\ **Last updated:** [October 8, 2017, 9:05am UTC](https://discuss.elastic.co/t/fetch-data-from-oracle-database-using-logstash/103134 "2017-10-08T09:05:47Z")
I'm using following config file: input { jdbc { jdbc\_validate\_connection =\> true jdbc\_driver\_library =\> "/app/logstash-5.6.2/lib/ojdbc7.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connect… --- ## [Replacement @timestamp stop show any result in Kibana with enabled time filter](https://discuss.elastic.co/t/replacement-timestamp-stop-show-any-result-in-kibana-with-enabled-time-filter/103131)
**Author:** [@artcont](https://discuss.elastic.co/u/artcont)\ **Replies:** 0\ **Last updated:** [October 8, 2017, 12:57am UTC](https://discuss.elastic.co/t/replacement-timestamp-stop-show-any-result-in-kibana-with-enabled-time-filter/103131 "2017-10-08T00:57:46Z")
Hello, i have issue with settings up Kibana and Logstash. What actually happens. I setup filter date in logstash for replace @timeshtamp with my actual time from log. I configure an index pattern in Kibana with "Time … --- ## [Logstash filter elasticsearch open connections issue](https://discuss.elastic.co/t/logstash-filter-elasticsearch-open-connections-issue/103091)
**Author:** [@MaheshP](https://discuss.elastic.co/u/MaheshP)\ **Replies:** 9\ **Last updated:** [October 7, 2017, 9:55pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticsearch-open-connections-issue/103091 "2017-10-07T21:55:57Z")
Hello, Currently we are trying to send data from kafka to elasticsearch and in between we used logstash filter elasticsearch plugin to query for previous documents timestamp and other fields, at that time open connectio… --- ## [Logstash.outputs.elasticsearch is trying to connect to another elasticsearch](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-is-trying-to-connect-to-another-elasticsearch/101526)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 6\ **Last updated:** [October 7, 2017, 6:51pm UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-is-trying-to-connect-to-another-elasticsearch/101526 "2017-10-07T18:51:40Z")
I'm following Running Logstash on Docker | Logstash Reference \[5.X\] | Elastic here is my logstash's pipeline configuration: # cat ./usr/share/logstash/pipeline/test.conf input { beats { port =\> 5044 } } output… --- ## [Jdbc-input-plugin can handle limited number of sql fields](https://discuss.elastic.co/t/jdbc-input-plugin-can-handle-limited-number-of-sql-fields/103092)
**Author:** [@enrico\_villa](https://discuss.elastic.co/u/enrico_villa)\ **Replies:** 1\ **Last updated:** [October 7, 2017, 7:50am UTC](https://discuss.elastic.co/t/jdbc-input-plugin-can-handle-limited-number-of-sql-fields/103092 "2017-10-07T07:50:00Z")
Hi There, I'm importing to ES from mysql , via logstash (latest) and jdbc-input, a 200 fields table logstash (ran via command line using -f) was existing without any error so I activated mysql logging and verified … --- ## [Need help with filter aggregate for nested elements](https://discuss.elastic.co/t/need-help-with-filter-aggregate-for-nested-elements/103100)
**Author:** [@chrisgo](https://discuss.elastic.co/u/chrisgo)\ **Replies:** 0\ **Last updated:** [October 7, 2017, 4:07am UTC](https://discuss.elastic.co/t/need-help-with-filter-aggregate-for-nested-elements/103100 "2017-10-07T04:07:21Z")
Hi, Been trying to use the aggregate filter to build nested objects. I think my config is correct but maybe I am running it wrong This is my setup (Elasticsearch 5.6, Logstash 5.6, debian 9/stretch) orders id nam… --- ## [How do I replace timestamp field with the time stamp field inside my log file?](https://discuss.elastic.co/t/how-do-i-replace-timestamp-field-with-the-time-stamp-field-inside-my-log-file/102625)
**Author:** [@magdieldominguez](https://discuss.elastic.co/u/magdieldominguez)\ **Replies:** 6\ **Last updated:** [October 6, 2017, 9:20pm UTC](https://discuss.elastic.co/t/how-do-i-replace-timestamp-field-with-the-time-stamp-field-inside-my-log-file/102625 "2017-10-06T21:20:39Z")
Hi i am very new to the elk stack. I have a log file that shows the date and time of when a file was processed but when I send it off to elasticsearch the timestamp field that shows up is the current date and time. How d… --- ## [Persistent queues statistics](https://discuss.elastic.co/t/persistent-queues-statistics/90724)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 9:05pm UTC](https://discuss.elastic.co/t/persistent-queues-statistics/90724 "2017-10-06T21:05:24Z")
hi All! just a quick question regarding the statistics with persistent queues enabled: the pipeline stats command localhost:9600/\_node/stats/pipeline?pretty shows an empty queue: "queue" : { "events" : 0,… --- ## [Need to split a field and use part of it in conditionals](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917)
**Author:** [@vikas1590](https://discuss.elastic.co/u/vikas1590)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 8:42pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917 "2017-10-06T20:42:13Z")
I have an event with fields like: "description" =\> "The description\_53", "network" =\> "network\_b", "duration" =\> 600, "start\_time" =\> "1493596800", "node" =\> "node\_b", "device" =\> "device\_53" This event is poste… --- ## [Can't add txt files to elastic search](https://discuss.elastic.co/t/cant-add-txt-files-to-elastic-search/102699)
**Author:** [@OsymandiasII](https://discuss.elastic.co/u/OsymandiasII)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 8:24pm UTC](https://discuss.elastic.co/t/cant-add-txt-files-to-elastic-search/102699 "2017-10-06T20:24:31Z")
hi I want to index txt in elastic search with Logstash. the problem is that logstash do not recognise the index i'm using. I m quite new to ELK so maybe the solution is simple. this is my config file : input { file… --- ## [Logstash runs as service but stops sending logs over http after some time](https://discuss.elastic.co/t/logstash-runs-as-service-but-stops-sending-logs-over-http-after-some-time/102938)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 8:12pm UTC](https://discuss.elastic.co/t/logstash-runs-as-service-but-stops-sending-logs-over-http-after-some-time/102938 "2017-10-06T20:12:02Z")
Hi, I am running Logstash 5 as a service on Redhat machine. Logstash status says, it's running but after some time it stops completely sending logs over http(to another Logstash). I don't see any errors in Logs(Level:De… --- ## [Command line works, service does not](https://discuss.elastic.co/t/command-line-works-service-does-not/102857)
**Author:** [@Frizz\_Supertramp](https://discuss.elastic.co/u/Frizz_Supertramp)\ **Replies:** 4\ **Last updated:** [October 6, 2017, 8:06pm UTC](https://discuss.elastic.co/t/command-line-works-service-does-not/102857 "2017-10-06T20:06:54Z")
I have a very simple config that should produce tons of output: input { file { path =\> "/var/log/glusterfs/\*.log" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } output { stdout { codec =\> … --- ## [Sticking same top-level fields](https://discuss.elastic.co/t/sticking-same-top-level-fields/102945)
**Author:** [@Valsek](https://discuss.elastic.co/u/Valsek)\ **Replies:** 4\ **Last updated:** [October 6, 2017, 7:53pm UTC](https://discuss.elastic.co/t/sticking-same-top-level-fields/102945 "2017-10-06T19:53:52Z")
Hello. I've next json generated by tshark and exported with flag -T ek: { "timestamp": "1507110658491", "layers": { "frame": { "frame\_frame\_interface\_id": "0", "frame\_frame\_encap\_type": "1", "frame\_frame\_time": "Oct… --- ## [How to remove nested fields in logstash 5.4](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190)
**Author:** [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 5:05pm UTC](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190 "2017-10-06T17:05:43Z")
Hi, I have below json. I want to remove all paths.\*.get.parameters.default fields. Could not find the right solution. Please advise. Thank you. --- ## [Organising multiline events with multithreaded log lines](https://discuss.elastic.co/t/organising-multiline-events-with-multithreaded-log-lines/103040)
**Author:** [@A.McBride](https://discuss.elastic.co/u/A.McBride)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 4:23pm UTC](https://discuss.elastic.co/t/organising-multiline-events-with-multithreaded-log-lines/103040 "2017-10-06T16:23:52Z")
I've been trying to combine log lines based on a thread number, but the problem is that multiple processes write to a single log file, meaning we have process blocks interlaced with other process blocks. I want to be abl… --- ## [Improve logstash starting time?](https://discuss.elastic.co/t/improve-logstash-starting-time/103016)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [October 6, 2017, 4:21pm UTC](https://discuss.elastic.co/t/improve-logstash-starting-time/103016 "2017-10-06T16:21:45Z")
Hi, I know, it is not the hardware logstash is designed for, but hopefully you have some idea which might help me. I am running a nextcloud instance an would like to visualize server's logs (nextcloud, apache, metrics)… --- ## [Grok extract the PR number](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024)
**Author:** [@erikkn](https://discuss.elastic.co/u/erikkn)\ **Replies:** 5\ **Last updated:** [October 6, 2017, 3:11pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024 "2017-10-06T15:11:17Z")
Hey guys, I have a log file with ~500 lines and I need to extract a few lines. One of the lines I want to extract is: pullrequest=pull request number . Could someone tell me what custom grok pattern I should use to 'onl… --- ## [Logstash index to come from a csv field](https://discuss.elastic.co/t/logstash-index-to-come-from-a-csv-field/101234)
**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 2:32pm UTC](https://discuss.elastic.co/t/logstash-index-to-come-from-a-csv-field/101234 "2017-10-06T14:32:40Z")
Hello, I have a field with columns A,B,C where A represents the source of the file. Many sources send csv files to one location and the index should be according to the source. For example: file1.csv A=source1 --\> i… --- ## [Missing CSV records in ElasticSearch](https://discuss.elastic.co/t/missing-csv-records-in-elasticsearch/102497)
**Author:** [@xnaud](https://discuss.elastic.co/u/xnaud)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/missing-csv-records-in-elasticsearch/102497 "2017-10-06T13:44:15Z")
I am importing into Amazon Elasticsearch with logstash 5.6.2 a 120MB CSV file that contains 27,858 US cities with their polygons. I run logstash with stdin and not with a file so it stops at the end. when importing, I… --- ## [Changing Log location from console to file](https://discuss.elastic.co/t/changing-log-location-from-console-to-file/102976)
**Author:** [@Zama\_Las](https://discuss.elastic.co/u/Zama_Las)\ **Replies:** 0\ **Last updated:** [October 6, 2017, 8:43am UTC](https://discuss.elastic.co/t/changing-log-location-from-console-to-file/102976 "2017-10-06T08:43:57Z")
I have installed logstash using docker. It is running fine. It seems by default in docker installation, log output goes to console. I want that log output should go to file too along with console. For this I added the b… --- ## [Using the csv output plugin](https://discuss.elastic.co/t/using-the-csv-output-plugin/103008)
**Author:** [@Cristian](https://discuss.elastic.co/u/Cristian)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 1:19pm UTC](https://discuss.elastic.co/t/using-the-csv-output-plugin/103008 "2017-10-06T13:19:27Z")
Hi All, I use the http\_poller plugin to import data and get it in a nice json format. I also use the filter "split" to split the docs on "candles" and get this: { "@timestamp" =\> 2017-10-06T12:48:01.197Z, "gra… --- ## [Java Logs patterns](https://discuss.elastic.co/t/java-logs-patterns/102996)
**Author:** [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Replies:** 6\ **Last updated:** [October 6, 2017, 1:16pm UTC](https://discuss.elastic.co/t/java-logs-patterns/102996 "2017-10-06T13:16:40Z")
please advice - is this format correct to review structured java log? input { beats { port =\>5044 } } output { elasticsearch { hosts =\> "localhost:9200" manage\_template =\> false index =\> \["NUMBER:thread", "me… --- ## [Unable to listen on port 5044 for logstash](https://discuss.elastic.co/t/unable-to-listen-on-port-5044-for-logstash/103003)
**Author:** [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\ **Replies:** 0\ **Last updated:** [October 6, 2017, 12:21pm UTC](https://discuss.elastic.co/t/unable-to-listen-on-port-5044-for-logstash/103003 "2017-10-06T12:21:41Z")
Hi, I modified the logstash conf file and ran the --config.reload.automatic however my beats are unable to send data to logstash. Below is the error excerpt from the logstash-plain.log file. \[2017-10-06T08:19:10,007\]\[… --- ## [Grok performance problem when parsing dots, dashs, underscore](https://discuss.elastic.co/t/grok-performance-problem-when-parsing-dots-dashs-underscore/102985)
**Author:** [@simon.t](https://discuss.elastic.co/u/simon.t)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 11:19am UTC](https://discuss.elastic.co/t/grok-performance-problem-when-parsing-dots-dashs-underscore/102985 "2017-10-06T11:19:31Z")
Hi all, I'm issuing a performance problem with grok filter. I use filebeat 5.4.6 to send log file event to logstash 5.4.6. I made a very simple grok filter in logstash to extract path and filename of the log file from… --- ## [Influx DB Output use event fields problem](https://discuss.elastic.co/t/influx-db-output-use-event-fields-problem/102994)
**Author:** [@999chris](https://discuss.elastic.co/u/999chris)\ **Replies:** 0\ **Last updated:** [October 6, 2017, 11:05am UTC](https://discuss.elastic.co/t/influx-db-output-use-event-fields-problem/102994 "2017-10-06T11:05:45Z")
Hi All, I'm using Logstash to manipulate the output of Telegraf before sending the information to InfluxDB. Here is an example event after filters (rubydebug output): { "fields" =\> { "Percent\_User\_Time"… --- ## [Logstash filter jdbc\_streaming: how to get the target value](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959)
**Author:** [@ras\_dvt](https://discuss.elastic.co/u/ras_dvt)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 10:19am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959 "2017-10-06T10:19:08Z")
Hello, I use jdbc\_streaming filter to get data from an Oracle database and have something like this: filter { ... jdbc\_streaming { jdbc\_driver\_library =\> "..." jdbc\_driver\_class =\> "..." jdbc\_connection\_string =\>… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=895) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=897)