# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=898 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 899 --- ## [Jdbc\_password\_filepath with jdbc\_streaming filter plugin](https://discuss.elastic.co/t/jdbc-password-filepath-with-jdbc-streaming-filter-plugin/102576)
**Author:** [@webrod](https://discuss.elastic.co/u/webrod)\ **Replies:** 1\ **Last updated:** [October 5, 2017, 12:15pm UTC](https://discuss.elastic.co/t/jdbc-password-filepath-with-jdbc-streaming-filter-plugin/102576 "2017-10-05T12:15:26Z")
Hi, do I miss something or the "jdbc\_password\_filepath" parameter is specific to jdbc input plugin? I don't see such parameter with jdbc\_streaming filter plugin while the need is the same. thanks, Rod --- ## [How to dynamically add a column in the output and manipulate the date](https://discuss.elastic.co/t/how-to-dynamically-add-a-column-in-the-output-and-manipulate-the-date/102729)
**Author:** [@ssagarwal17](https://discuss.elastic.co/u/ssagarwal17)\ **Replies:** 3\ **Last updated:** [October 5, 2017, 11:17am UTC](https://discuss.elastic.co/t/how-to-dynamically-add-a-column-in-the-output-and-manipulate-the-date/102729 "2017-10-05T11:17:51Z")
How can i dynamically pass the date in the query 'Statment' and also use the same date as a output column? I want the date to be 2 days behind the execution date input { jdbc { jdbc\_driver\_library =\> "sqljdbc42.jar" … --- ## [Return all nested fields](https://discuss.elastic.co/t/return-all-nested-fields/102818)
**Author:** [@ddebast](https://discuss.elastic.co/u/ddebast)\ **Replies:** 1\ **Last updated:** [October 5, 2017, 9:54am UTC](https://discuss.elastic.co/t/return-all-nested-fields/102818 "2017-10-05T09:54:51Z")
Hello, My use case is to forward all nested fields (in this case events\_\*) to another system. This is my current output \], "level" =\> "Information", "log\_name" =\> "Security", "record… --- ## [Logstash-5.6.2 jruby error](https://discuss.elastic.co/t/logstash-5-6-2-jruby-error/102786)
**Author:** [@sidra\_89](https://discuss.elastic.co/u/sidra_89)\ **Replies:** 2\ **Last updated:** [October 5, 2017, 9:53am UTC](https://discuss.elastic.co/t/logstash-5-6-2-jruby-error/102786 "2017-10-05T09:53:27Z")
not able to run logstash keep on getting jrudy error the below image show the details using windows 10 and java 9 \[image\] --- ## [Logstash InfluxDB Output Plugin preformance](https://discuss.elastic.co/t/logstash-influxdb-output-plugin-preformance/102446)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 8\ **Last updated:** [October 5, 2017, 8:53am UTC](https://discuss.elastic.co/t/logstash-influxdb-output-plugin-preformance/102446 "2017-10-05T08:53:44Z")
Hello, I am using Logstash 5.6.1-1 on Centos 7. I have my input configured as an HTTP input, some filters and an output writing to InfluxDB, which is on another Linux server. My output configuration is as follows: outp… --- ## [Getting Failed Action error in logstash-plain.log](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101)
**Author:** [@meaniljangra](https://discuss.elastic.co/u/meaniljangra)\ **Replies:** 8\ **Last updated:** [October 5, 2017, 8:12am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101 "2017-10-05T08:12:35Z")
I am sending the logs to ELK server from different system using filebeat. I am getting only one line log information in Kibana. Other logs are not present. I am sending more than 100 lines of logs. When I checked logstas… --- ## [Pipeline starts but data does not ingest logs from json files](https://discuss.elastic.co/t/pipeline-starts-but-data-does-not-ingest-logs-from-json-files/102254)
**Author:** [@Samireddy\_Keerthi](https://discuss.elastic.co/u/Samireddy_Keerthi)\ **Replies:** 2\ **Last updated:** [October 5, 2017, 7:24am UTC](https://discuss.elastic.co/t/pipeline-starts-but-data-does-not-ingest-logs-from-json-files/102254 "2017-10-05T07:24:34Z")
Below is my logstash.conf input { file { path =\> "C:/logs/msglogin/\*.json" start\_position =\> "beginning" sincedb\_path =\> "null" codec=\>"json" } } filter { json { source =\> "message" } } output { elasticsea… --- ## [Mutate plugin in Grok Filter](https://discuss.elastic.co/t/mutate-plugin-in-grok-filter/101945)
**Author:** [@akarsha](https://discuss.elastic.co/u/akarsha)\ **Replies:** 9\ **Last updated:** [October 5, 2017, 6:18am UTC](https://discuss.elastic.co/t/mutate-plugin-in-grok-filter/101945 "2017-10-05T06:18:49Z")
I want one of my field to be converted to "integer". I tried using mutate option in grok, however, not getting the change reflected in kibana, also not getting any exception in logstash logs. config file: filter { if … --- ## [Grok Patterns not execute properly on logstash filter](https://discuss.elastic.co/t/grok-patterns-not-execute-properly-on-logstash-filter/102418)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 5\ **Last updated:** [October 5, 2017, 5:22am UTC](https://discuss.elastic.co/t/grok-patterns-not-execute-properly-on-logstash-filter/102418 "2017-10-05T05:22:45Z")
I have following log which has to be normalized using grok patterns. \<46\>Sep 29 12:10:36 SXX-XX-XO SFIMS: \[133:51:1\] dcerpc2: SMB - Outstanding requests with the same MID \[Impact: Currently Not Vulnerable\] From \\"XXX-XO… --- ## [Problem with \[mutate \>\> convert\] more that one field : Error registering plugin](https://discuss.elastic.co/t/problem-with-mutate-convert-more-that-one-field-error-registering-plugin/102776)
**Author:** [@enrico\_villa](https://discuss.elastic.co/u/enrico_villa)\ **Replies:** 2\ **Last updated:** [October 5, 2017, 3:43am UTC](https://discuss.elastic.co/t/problem-with-mutate-convert-more-that-one-field-error-registering-plugin/102776 "2017-10-05T03:43:04Z")
I run smoothly my logstash config with only one mutate:convert command, but if i add more than one i got this error .. I tried many syntaxes to specifiy multiple conversions but with no luck .. tnx for any help ! \[… --- ## [Logstash errors after playing around with x-pack](https://discuss.elastic.co/t/logstash-errors-after-playing-around-with-x-pack/102604)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 4\ **Last updated:** [October 5, 2017, 2:02am UTC](https://discuss.elastic.co/t/logstash-errors-after-playing-around-with-x-pack/102604 "2017-10-05T02:02:59Z")
I did start to add x-pack but am holding off for another week or two so I commented out in logstash.yml xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.url: http://X.X.X.X:9200 and removed any remnants o… --- ## [Logstash on docker, performance with IRC-\>Slack](https://discuss.elastic.co/t/logstash-on-docker-performance-with-irc-slack/102198)
**Author:** [@Jackson\_Pollock](https://discuss.elastic.co/u/Jackson_Pollock)\ **Replies:** 2\ **Last updated:** [October 5, 2017, 1:35am UTC](https://discuss.elastic.co/t/logstash-on-docker-performance-with-irc-slack/102198 "2017-10-05T01:35:21Z")
Hello, I am running your docker image: version: '2' services: logstash: image: docker.elastic.co/logstash/logstash:5.6.2 volumes: - ./pipeline:/usr/share/logstash/pipeline - ./config/logstash.yml:/usr/share/logst… --- ## [Http\_poller and auth tokens](https://discuss.elastic.co/t/http-poller-and-auth-tokens/102771)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 10:32pm UTC](https://discuss.elastic.co/t/http-poller-and-auth-tokens/102771 "2017-10-04T22:32:48Z")
I've got a scenario where using an auth token would be preferred over basic auth. I know http\_poller doesn't handle this currently, but do you think it might be possible in the future? I suppose one big challenge is th… --- ## [Logstash filter only couple lines from suricatas eve.json](https://discuss.elastic.co/t/logstash-filter-only-couple-lines-from-suricatas-eve-json/102430)
**Author:** [@Tony1](https://discuss.elastic.co/u/Tony1)\ **Replies:** 1\ **Last updated:** [October 4, 2017, 8:39pm UTC](https://discuss.elastic.co/t/logstash-filter-only-couple-lines-from-suricatas-eve-json/102430 "2017-10-04T20:39:44Z")
Hi everyone, I try to do logstash filtering, where i can get only couple lines from suricata's eve.json file. It have lot of information, but i want only like a " source ip, dest. ip etc" info to kibana. Any help ? Tha… --- ## [Groke pattern request](https://discuss.elastic.co/t/groke-pattern-request/102758)
**Author:** [@Amol\_Haval](https://discuss.elastic.co/u/Amol_Haval)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 8:28pm UTC](https://discuss.elastic.co/t/groke-pattern-request/102758 "2017-10-04T20:28:01Z")
I have below message from logstash input . I want to parse below json within message { "message": "\\u0000\\u0000\\u0000\\u0000\\u0004\\u0002�\\u0006{"\_id" : {"$oid" : "59d03207e4b0db37e9f741e9"},"deviceId" : "{4692852a-80ba-… --- ## [Properties file read in Logstash](https://discuss.elastic.co/t/properties-file-read-in-logstash/102477)
**Author:** [@kant.gaurav](https://discuss.elastic.co/u/kant.gaurav)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 4:40pm UTC](https://discuss.elastic.co/t/properties-file-read-in-logstash/102477 "2017-10-04T16:40:34Z")
my scenario is I have a property file. in which data is in below format key = value abc=123 xyz=456 in logstash when I am processing logs, each log line has a key. Now I need to add a field whose value is from prope… --- ## [Unable to install "logstash-input-eventlog" plugin (windows event viewer logs)](https://discuss.elastic.co/t/unable-to-install-logstash-input-eventlog-plugin-windows-event-viewer-logs/102388)
**Author:** [@scch](https://discuss.elastic.co/u/scch)\ **Replies:** 7\ **Last updated:** [October 4, 2017, 5:53pm UTC](https://discuss.elastic.co/t/unable-to-install-logstash-input-eventlog-plugin-windows-event-viewer-logs/102388 "2017-10-04T17:53:36Z")
\[root@redes logstash\]# logstash-plugin install logstash-input-eventlog Validating logstash-input-eventlog Installing logstash-input-eventlog Error Bundler::InstallError, retrying 1/10 An error occurred while installi… --- ## [Logfile Input - Timestamp fieled ismissing](https://discuss.elastic.co/t/logfile-input-timestamp-fieled-ismissing/102736)
**Author:** [@baldy2811](https://discuss.elastic.co/u/baldy2811)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 5:00pm UTC](https://discuss.elastic.co/t/logfile-input-timestamp-fieled-ismissing/102736 "2017-10-04T17:00:34Z")
Hi there, i created some filter for nginx logs discribed at this website: https://www.elastic.co/guide/en/logstash/current/logstash-config-for-filebeat-modules.html#parsing-nginx Logstash shows me some error: \] An une… --- ## [Error when running this command - bin/logstash-plugin install logstash-input-syslog](https://discuss.elastic.co/t/error-when-running-this-command-bin-logstash-plugin-install-logstash-input-syslog/102718)
**Author:** [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 2:59pm UTC](https://discuss.elastic.co/t/error-when-running-this-command-bin-logstash-plugin-install-logstash-input-syslog/102718 "2017-10-04T14:59:46Z")
URI::InvalidURIError: bad URI(is not URI?): IP split at /usr/share/logstash/vendor/jruby/lib/ruby/stdlib/uri/rfc3986\_parser.rb:67 parse at /usr/share/logstash/vendor/jruby/lib/ruby/stdlib/uri/rfc3986\_parser.rb:73 pars… --- ## [Installing beats plugin logstash in docker](https://discuss.elastic.co/t/installing-beats-plugin-logstash-in-docker/102703)
**Author:** [@vaidabhishek](https://discuss.elastic.co/u/vaidabhishek)\ **Replies:** 1\ **Last updated:** [October 4, 2017, 12:46pm UTC](https://discuss.elastic.co/t/installing-beats-plugin-logstash-in-docker/102703 "2017-10-04T12:46:47Z")
I am testing a ELK and Beats integration on my local machine and want to fire up 4 docker containers with E, L, K and B. I'm unable to figure out how to install beats plugin for Logstash. Can someone please help me get t… --- ## [Get file name from s3 file](https://discuss.elastic.co/t/get-file-name-from-s3-file/102683)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 1\ **Last updated:** [October 4, 2017, 12:14pm UTC](https://discuss.elastic.co/t/get-file-name-from-s3-file/102683 "2017-10-04T12:14:32Z")
Hi i have s3 bucket from where i taking csv file and uploading in to ES . i stuck on how to get file name which i have in s3 , beacuse i am using s3 file name as Index name . My config file - input{ s3{ bucket =\> … --- ## [Logstash unable to read messages from kafka](https://discuss.elastic.co/t/logstash-unable-to-read-messages-from-kafka/102666)
**Author:** [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\ **Replies:** 1\ **Last updated:** [October 4, 2017, 11:59am UTC](https://discuss.elastic.co/t/logstash-unable-to-read-messages-from-kafka/102666 "2017-10-04T11:59:36Z")
Following is the configuration : input { kafka { codec =\> "json" bootstrap\_servers =\> "10.0.20.50:4000,10.0.20.50:4001,10.0.20.4:4000,10.0.20.4:4001,10.0.20.62:4000,10.0.20.62:4001" group\_id =\> "logstash"… --- ## [Logstash-input-beats connections doesn't close properly - Am I doing something wrong?](https://discuss.elastic.co/t/logstash-input-beats-connections-doesnt-close-properly-am-i-doing-something-wrong/102377)
**Author:** [@appsee](https://discuss.elastic.co/u/appsee)\ **Replies:** 0\ **Last updated:** [October 1, 2017, 2:05pm UTC](https://discuss.elastic.co/t/logstash-input-beats-connections-doesnt-close-properly-am-i-doing-something-wrong/102377 "2017-10-01T14:05:50Z")
Hello, I have around 50 filebeats with this configuration: output: logstash: hosts: \["\*\*\*\*\*\*:10200"\] shipper: logging: level: warning to\_files: true to\_syslog: false files: path: /var/log/filebeat … --- ## [Logstash v6 beta with multiple pipelines configuration](https://discuss.elastic.co/t/logstash-v6-beta-with-multiple-pipelines-configuration/102559)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 9:29am UTC](https://discuss.elastic.co/t/logstash-v6-beta-with-multiple-pipelines-configuration/102559 "2017-10-04T09:29:40Z")
Hello, Thanks for reading this. I am trying out Logstash v6 and multiple pipeline configuration, as per https://www.elastic.co/guide/en/logstash/6.x/multiple-pipelines.html I have configured my pipelines.yml follows: … --- ## [Grok for string not followed by a second string combination](https://discuss.elastic.co/t/grok-for-string-not-followed-by-a-second-string-combination/102425)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 8\ **Last updated:** [October 4, 2017, 7:47am UTC](https://discuss.elastic.co/t/grok-for-string-not-followed-by-a-second-string-combination/102425 "2017-10-04T07:47:25Z")
Hi All, Apologies if this has been asked before but I couldn't find a similar question in the forum. I have the following log file line entry: Tue Apr 05 16:31:39 2016 1 10.102.180.12 37088 d:\\directory\\Excel filenam… --- ## [Filebeat & Logstash SSL issue | ERR Connecting error publishing events (retrying): remote error: tls: internal error](https://discuss.elastic.co/t/filebeat-logstash-ssl-issue-err-connecting-error-publishing-events-retrying-remote-error-tls-internal-error/102229)
**Author:** [@franco.wolf](https://discuss.elastic.co/u/franco.wolf)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 6:56am UTC](https://discuss.elastic.co/t/filebeat-logstash-ssl-issue-err-connecting-error-publishing-events-retrying-remote-error-tls-internal-error/102229 "2017-10-04T06:56:58Z")
Hi all, I enabled SSL for filebeat and logstash and after that I recieve: ERR Connecting error publishing events (retrying): remote error: tls: internal error Some informations about the environment: filebeat version… --- ## [Migrating daily indices to monthly](https://discuss.elastic.co/t/migrating-daily-indices-to-monthly/102636)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 5\ **Last updated:** [October 4, 2017, 6:47am UTC](https://discuss.elastic.co/t/migrating-daily-indices-to-monthly/102636 "2017-10-04T06:47:17Z")
Hi, I am trying to collapse daily indices to monthly but when i try to match the count of both old and new indices, it does not match. This is my current logstash config look like. input { elasticsearch { hosts … --- ## [Netflow v9 not being recieved over UDP](https://discuss.elastic.co/t/netflow-v9-not-being-recieved-over-udp/101103)
**Author:** [@djluko](https://discuss.elastic.co/u/djluko)\ **Replies:** 5\ **Last updated:** [October 4, 2017, 5:02am UTC](https://discuss.elastic.co/t/netflow-v9-not-being-recieved-over-udp/101103 "2017-10-04T05:02:19Z")
Having a very strange problem I'm hoping the logstash/Elastic community will have some guidance on. I'm trying to get logstash 5.6.1 to process Netflow v9 records, then send to a remote Elasticsearch instance, also v5.6… --- ## [5.6 fundamentally broken](https://discuss.elastic.co/t/5-6-fundamentally-broken/102640)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 2:33am UTC](https://discuss.elastic.co/t/5-6-fundamentally-broken/102640 "2017-10-04T02:33:39Z")
I don't know if this is logstash or elastic but 5.6 and 5.4 to some extent are fundamentally broken. On 5.4 I can't get the KV filter to create any mapping. Opened a topic but no solution. On 5.6 the netflow codec and… --- ## [SQS Input Plugin - Message Attributes](https://discuss.elastic.co/t/sqs-input-plugin-message-attributes/102639)
**Author:** [@shreyask](https://discuss.elastic.co/u/shreyask)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 1:40am UTC](https://discuss.elastic.co/t/sqs-input-plugin-message-attributes/102639 "2017-10-04T01:40:54Z")
Is it possible to fetch the message attributes with the plugin or is there a workaround to get the message attributes? [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=897) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=899)