# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=905 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 906 --- ## [Logstash crashed and spawning new process when tried installing new plugins](https://discuss.elastic.co/t/logstash-crashed-and-spawning-new-process-when-tried-installing-new-plugins/99077)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 4\ **Last updated:** [September 22, 2017, 4:29am UTC](https://discuss.elastic.co/t/logstash-crashed-and-spawning-new-process-when-tried-installing-new-plugins/99077 "2017-09-22T04:29:18Z")
I have logstash v5.0.1 running in Redhat Enterprise v6.8. Recently, I tried to install plugin "logstash-output-email" using command-line from Internet using below commands. wget https://api.rubygems.org/latest\_specs.4.8… --- ## [Logstash geoip](https://discuss.elastic.co/t/logstash-geoip/101255)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 4\ **Last updated:** [September 21, 2017, 12:23pm UTC](https://discuss.elastic.co/t/logstash-geoip/101255 "2017-09-21T12:23:30Z")
Hello, I am trying to get the geoip working with my firewall Logstash config, relevant part udp { tags =\> "cisco-asa" type =\> "cisco-asa" port =\> 5047 } geoip { source =\> "dst\_ip" target =\> "ge… --- ## [\[FATAL\] An unexpected error occured](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216)
**Author:** [@Louise](https://discuss.elastic.co/u/Louise)\ **Replies:** 5\ **Last updated:** [September 21, 2017, 9:21pm UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216 "2017-09-21T21:21:26Z")
I am new with the Elasticsearch stak and I have a fatal error when trying to configure Logstash since I have deleted and re-downloaded it. It used to work but I thought the connection with Elasticsearch and Kibana was st… --- ## [Install filebeat](https://discuss.elastic.co/t/install-filebeat/101353)
**Author:** [@Erick\_Garcia\_Perez](https://discuss.elastic.co/u/Erick_Garcia_Perez)\ **Replies:** 1\ **Last updated:** [September 21, 2017, 9:12pm UTC](https://discuss.elastic.co/t/install-filebeat/101353 "2017-09-21T21:12:21Z")
Hi, how can i install filebeat in opensuse and configure for read remote log with logstash? --- ## [Convert Timestamp to UTC+0 and keep microseconds](https://discuss.elastic.co/t/convert-timestamp-to-utc-0-and-keep-microseconds/100811)
**Author:** [@Dr-Crow](https://discuss.elastic.co/u/Dr-Crow)\ **Replies:** 11\ **Last updated:** [September 21, 2017, 7:12pm UTC](https://discuss.elastic.co/t/convert-timestamp-to-utc-0-and-keep-microseconds/100811 "2017-09-21T19:12:14Z")
I am having a issue with my messages being out of order when I sort on @timestamp in Elastic Search. This is because @timestamp field does not store microseconds. What I want to do is take the timestamps I am getting fro… --- ## [Index creation based on file name](https://discuss.elastic.co/t/index-creation-based-on-file-name/101307)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 3\ **Last updated:** [September 21, 2017, 4:36pm UTC](https://discuss.elastic.co/t/index-creation-based-on-file-name/101307 "2017-09-21T16:36:46Z")
Hi All i want to create dynamic index based on the file name -- currently my input part is - input { file { path =\> "E:\\Local\_Elasticsearch\\logstashv5\\datafiles/\*.csv" start\_position =\> "beginning" } } and my … --- ## [How Can I find unmatched logs with pattern grok?](https://discuss.elastic.co/t/how-can-i-find-unmatched-logs-with-pattern-grok/101302)
**Author:** [@JaviiPG](https://discuss.elastic.co/u/JaviiPG)\ **Replies:** 1\ **Last updated:** [September 21, 2017, 2:23pm UTC](https://discuss.elastic.co/t/how-can-i-find-unmatched-logs-with-pattern-grok/101302 "2017-09-21T14:23:19Z")
Hi everybody, I has been configured a ELK environment. It has working properly :smiley:. I have a grok filter that is valid for all APP logs. However i want be sure that all logs are adding to Elasticsearch. Are ther… --- ## [2 Logstash Conf File, only one works](https://discuss.elastic.co/t/2-logstash-conf-file-only-one-works/101325)
**Author:** [@feijiangnan](https://discuss.elastic.co/u/feijiangnan)\ **Replies:** 2\ **Last updated:** [September 21, 2017, 12:56pm UTC](https://discuss.elastic.co/t/2-logstash-conf-file-only-one-works/101325 "2017-09-21T12:56:26Z")
Hi there, I have 2 configuration files to process 2 log files from remote servers with filebeat, each one works by itself, but only one works if both of them are in /etc/logstash/conf.d Let's call the A and B, A is alw… --- ## [Error while installing Avro codec plugin](https://discuss.elastic.co/t/error-while-installing-avro-codec-plugin/101333)
**Author:** [@sxs1112](https://discuss.elastic.co/u/sxs1112)\ **Replies:** 0\ **Last updated:** [September 21, 2017, 12:50pm UTC](https://discuss.elastic.co/t/error-while-installing-avro-codec-plugin/101333 "2017-09-21T12:50:08Z")
Hi Am new to LS and am trying to install the Avro codec in my LS 5.5.2 but get the following error: Error Bundler::InstallError, retrying 1/10 An error occurred while installing logstash-core (5.5.2), and Bundler cann… --- ## [\[SOLVED\] Logstash 5.2.2 - Mutate string value to number](https://discuss.elastic.co/t/solved-logstash-5-2-2-mutate-string-value-to-number/100877)
**Author:** [@D-Sect](https://discuss.elastic.co/u/D-Sect)\ **Replies:** 2\ **Last updated:** [September 21, 2017, 10:25am UTC](https://discuss.elastic.co/t/solved-logstash-5-2-2-mutate-string-value-to-number/100877 "2017-09-21T10:25:48Z")
I am having an issue with a logstash 5.2.2 filter. I need to convert a string to an integer and it's failing. The approach I am taking may not be ideal. Here's the problem statement: A JMX MBean value reports a "metric\_v… --- ## [Unable to start logstash Pipeline - Error registering Plugin](https://discuss.elastic.co/t/unable-to-start-logstash-pipeline-error-registering-plugin/101298)
**Author:** [@Aarthy.Krishnamurthy](https://discuss.elastic.co/u/Aarthy.Krishnamurthy)\ **Replies:** 0\ **Last updated:** [September 21, 2017, 9:18am UTC](https://discuss.elastic.co/t/unable-to-start-logstash-pipeline-error-registering-plugin/101298 "2017-09-21T09:18:22Z")
Hi there, I am currently using Logstash 5.5, and when I start the plugin I am encountering the following error : \[2017-09-21T14:39:25,535\]\[ERROR\]\[logstash.pipeline \] Error registering plugin {:plugin=\>"#\ **Author:** [@rajath](https://discuss.elastic.co/u/rajath)\ **Replies:** 6\ **Last updated:** [September 21, 2017, 9:00am UTC](https://discuss.elastic.co/t/ad-parsing/98176 "2017-09-21T09:00:16Z") We are trying to parse Checkpoint logs but as there are multiple types of log formats. Depending on the blades we are running on Checkpoint the key value changes. if anyone has a conf file for checkpoint please share. --- ## [Help with particular grok pattern (SOLVED)](https://discuss.elastic.co/t/help-with-particular-grok-pattern-solved/101188)
**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\ **Replies:** 2\ **Last updated:** [September 21, 2017, 8:13am UTC](https://discuss.elastic.co/t/help-with-particular-grok-pattern-solved/101188 "2017-09-21T08:13:31Z")
Hi all, i have a little problem with this type of log: Wed Sep 20 16:02:39 2017 (186085) -7- ================= FUNCTOR WAITING FOR MSG ================= Wed Sep 20 16:02:39 2017 (284410) -7- \<----------RECVFROM \<- le… --- ## [Logstash\_error](https://discuss.elastic.co/t/logstash-error/101268)
**Author:** [@Srivathsan\_Raghu](https://discuss.elastic.co/u/Srivathsan_Raghu)\ **Replies:** 2\ **Last updated:** [September 21, 2017, 7:52am UTC](https://discuss.elastic.co/t/logstash-error/101268 "2017-09-21T07:52:11Z")
Im running logstash in windows..i got an error like below ERROR StatusLogger Log4j2 could not find a logging implementation. Please add lo g4j-core to the classpath. Using SimpleLogger to log to the console... NameErro… --- ## [Encrypting the certificate key for SSL](https://discuss.elastic.co/t/encrypting-the-certificate-key-for-ssl/100205)
**Author:** [@Ihjaz](https://discuss.elastic.co/u/Ihjaz)\ **Replies:** 3\ **Last updated:** [September 21, 2017, 7:25am UTC](https://discuss.elastic.co/t/encrypting-the-certificate-key-for-ssl/100205 "2017-09-21T07:25:32Z")
Hi, I've enabled SSL between Filebeat and Logstash. I have the following configuration in my logstash.conf input { beats { host =\> "10.129.179.39" port =\> 5044 ssl =\> true ssl\_cer… --- ## [Separate response time from message field](https://discuss.elastic.co/t/separate-response-time-from-message-field/101017)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 3\ **Last updated:** [September 21, 2017, 3:39am UTC](https://discuss.elastic.co/t/separate-response-time-from-message-field/101017 "2017-09-21T03:39:17Z")
\[image\] Hi I need to separate the response time in the Screenshot which is "0" and create a new field for it how to do this? --- ## [How to shutdown logstash after import csv](https://discuss.elastic.co/t/how-to-shutdown-logstash-after-import-csv/100973)
**Author:** [@Neal\_Shan](https://discuss.elastic.co/u/Neal_Shan)\ **Replies:** 4\ **Last updated:** [September 21, 2017, 2:11am UTC](https://discuss.elastic.co/t/how-to-shutdown-logstash-after-import-csv/100973 "2017-09-21T02:11:17Z")
I keep seeing this on topics, replied by @magnusbaeck Use the stdin input instead. Logstash will shut down by itself when stdin has been closed and all inputs has been processed. On the flip side, it Logstash dies for … --- ## [Logstash 5.6.0 not starting](https://discuss.elastic.co/t/logstash-5-6-0-not-starting/101241)
**Author:** [@kamalbeg](https://discuss.elastic.co/u/kamalbeg)\ **Replies:** 4\ **Last updated:** [September 21, 2017, 12:26am UTC](https://discuss.elastic.co/t/logstash-5-6-0-not-starting/101241 "2017-09-21T00:26:32Z")
Hello, I have 3 ES server running in cluster. I have x-pack install on all 3 ES, kibana and LS. They all are running ver 5.6.0 I am getting following error \[2017-09-20T17:45:14,760\]\[FATAL\]\[logstash.runner \] A… --- ## [KV filter stripping out parentheses](https://discuss.elastic.co/t/kv-filter-stripping-out-parentheses/101033)
**Author:** [@blaisefonseca](https://discuss.elastic.co/u/blaisefonseca)\ **Replies:** 1\ **Last updated:** [September 20, 2017, 7:41pm UTC](https://discuss.elastic.co/t/kv-filter-stripping-out-parentheses/101033 "2017-09-20T19:41:54Z")
I am using KV filter to split query string, however, the filter strips parentheses at the beginning and end, how can I avoid this? Below is my KV filter kv { target =\> "cs\_uri\_query" allow\_duplicate\_values =\> false … --- ## [PII data in ingested into the ELK environment](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051)
**Author:** [@kal](https://discuss.elastic.co/u/kal)\ **Replies:** 2\ **Last updated:** [September 20, 2017, 4:47pm UTC](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051 "2017-09-20T16:47:50Z")
Hello, we are needing to figure out if there's any personally identifiable information stored in our ELK stack, I did see a bunch of articles on finding CC numbers within the environment, but unless I am mistaken, it see… --- ## [Filter in input section](https://discuss.elastic.co/t/filter-in-input-section/101020)
**Author:** [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\ **Replies:** 3\ **Last updated:** [September 20, 2017, 11:25am UTC](https://discuss.elastic.co/t/filter-in-input-section/101020 "2017-09-20T11:25:34Z")
Hi , i added fields in filebeat configuration to identify different types of files My filebeat configuration input\_type: log paths: c:\\Users\\user1\\Desktop\\ELK\\server\_sftp.log.D\* fields: type\_log: sftp\_server i… --- ## [Logstash can not output to elasticsearch?](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119)
**Author:** [@bejjm](https://discuss.elastic.co/u/bejjm)\ **Replies:** 5\ **Last updated:** [September 20, 2017, 11:24am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119 "2017-09-20T11:24:11Z")
version : logstash 5.0.2 \\elasticsearch 5.0.2 1.My configuration file in /etc/logstash/config.d/test.conf： input { file{ path =\> "/home/installer/test//logs/test\_client.log" } } filter { grok { match =\> {"messag… --- ## [Logstash missing event when output set to elasticsearch](https://discuss.elastic.co/t/logstash-missing-event-when-output-set-to-elasticsearch/101153)
**Author:** [@bns\_frankpoon](https://discuss.elastic.co/u/bns_frankpoon)\ **Replies:** 0\ **Last updated:** [September 20, 2017, 11:10am UTC](https://discuss.elastic.co/t/logstash-missing-event-when-output-set-to-elasticsearch/101153 "2017-09-20T11:10:52Z")
Hi, I'm trying the elk stack for analyze and visualize data. I tried to configure logstash for standard output and elastisearch. If I only output to screen, it shows 5 records, perfect. If I set the output to elasticsea… --- ## [Unable to change format of sql\_last\_value](https://discuss.elastic.co/t/unable-to-change-format-of-sql-last-value/101151)
**Author:** [@kanchan](https://discuss.elastic.co/u/kanchan)\ **Replies:** 0\ **Last updated:** [September 20, 2017, 10:46am UTC](https://discuss.elastic.co/t/unable-to-change-format-of-sql-last-value/101151 "2017-09-20T10:46:49Z")
Hi, I am using sql\_last\_value for incremented record using jdbc input plugin.but it is giving value like: TIMESTAMP '2017-09-13 12:44:27.266000 +00:00' I wanna remove Timestamp from this how can i do this please sugge… --- ## [Nested grok filter or filtering a field using grok](https://discuss.elastic.co/t/nested-grok-filter-or-filtering-a-field-using-grok/100841)
**Author:** [@kumar.1989p](https://discuss.elastic.co/u/kumar.1989p)\ **Replies:** 5\ **Last updated:** [September 20, 2017, 7:00am UTC](https://discuss.elastic.co/t/nested-grok-filter-or-filtering-a-field-using-grok/100841 "2017-09-20T07:00:27Z")
Hello, So I have a CommonApache access log format in the below form: 8.6.7.9 - - \[10/Sep/2017:05:17:11 +0000\] "POST /integration/servletloadserviceupdate HTTP/1.0" 200 9157 So I have used the below filter: filter {… --- ## [Logstash loading same file after restart](https://discuss.elastic.co/t/logstash-loading-same-file-after-restart/101123)
**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\ **Replies:** 4\ **Last updated:** [September 20, 2017, 10:23am UTC](https://discuss.elastic.co/t/logstash-loading-same-file-after-restart/101123 "2017-09-20T10:23:35Z")
Hi all , whenever my logstash start , its load the same file again , this causing duplicate data in EC . this is my config file - input { file { path =\> "E:\\Local\_Elasticsearch\\logstashv5\\datafiles/\*.csv" start… --- ## [\[ERROR\]\[logstash.outputs.elasticsearch\] An unknown error occurred sending a bulk request to Elasticsearch](https://discuss.elastic.co/t/error-logstash-outputs-elasticsearch-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch/101107)
**Author:** [@Nikhil\_Jaiswal](https://discuss.elastic.co/u/Nikhil_Jaiswal)\ **Replies:** 1\ **Last updated:** [September 20, 2017, 9:56am UTC](https://discuss.elastic.co/t/error-logstash-outputs-elasticsearch-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch/101107 "2017-09-20T09:56:06Z")
Hi, I am getting this error while running logstash, i am not able to rectify the issue from this log, after running configtest , i am getting Configuration Ok message in screen. \[2017-09-20T11:33:29,335\]\[ERROR\]\[logstas… --- ## [Cannot parse logs with date filter](https://discuss.elastic.co/t/cannot-parse-logs-with-date-filter/100891)
**Author:** [@omer](https://discuss.elastic.co/u/omer)\ **Replies:** 3\ **Last updated:** [September 20, 2017, 9:09am UTC](https://discuss.elastic.co/t/cannot-parse-logs-with-date-filter/100891 "2017-09-20T09:09:17Z")
Hi; i am trying to parse my logs to fields but as you guess i failed :smiley: Here is a sample of my logs. \[INFO \] 23.08.2017 20:28:32.941 in \[pool-2-thread-20\] |com.defne.rbt.eventapi.client.kvp.EventJob:eventCall:23… --- ## [How to check if a document was successfully insert into elasticsearch](https://discuss.elastic.co/t/how-to-check-if-a-document-was-successfully-insert-into-elasticsearch/100995)
**Author:** [@karim.aloui](https://discuss.elastic.co/u/karim.aloui)\ **Replies:** 4\ **Last updated:** [September 20, 2017, 8:30am UTC](https://discuss.elastic.co/t/how-to-check-if-a-document-was-successfully-insert-into-elasticsearch/100995 "2017-09-20T08:30:07Z")
Hello, I'm using logstash to insert documents into ES, but i want to output in a file duplicated documents that ES failed to insert. Is there a way to check if a document insert into ES was successfull through logstas… --- ## [Logstash errors and warning](https://discuss.elastic.co/t/logstash-errors-and-warning/101132)
**Author:** [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)\ **Replies:** 0\ **Last updated:** [September 20, 2017, 8:24am UTC](https://discuss.elastic.co/t/logstash-errors-and-warning/101132 "2017-09-20T08:24:30Z")
Hello, We have some dashboards running in a docker (marathon). Logstash is considering that a closed connection to database as a warning. My question is : How to modify this ton consider these warning as a real errors? … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=904) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=906)