# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=911 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 912 --- ## [Parsing Json File with Logstash and Filebeat](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925)
**Author:** [@Mufashid](https://discuss.elastic.co/u/Mufashid)\ **Replies:** 3\ **Last updated:** [September 11, 2017, 12:04pm UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925 "2017-09-11T12:04:56Z")
Hi I am new to ES. I was trying to parse json file with logstash but I am getting error like below. Please help me to solve this issue Error \ **Author:** [@ashleyl](https://discuss.elastic.co/u/ashleyl)\ **Replies:** 8\ **Last updated:** [September 11, 2017, 9:23am UTC](https://discuss.elastic.co/t/til-map-failed-to-show-locations-in-map-error-the-database-provided-is-invalid-or-corrupted/99122 "2017-09-11T09:23:06Z") Hi Elastic Support Manager, Please help to check how to fix below issues. I use filebeat send log to logstash-elasticsearch-kibana(host). Kibana - Version: 5.4.2 logstash 5.5.1 filebeat version 5.5.1 Issues: (1)Ti… --- ## [Did Logstash 1.5.3 version is compatible with Solaris 11.3 version](https://discuss.elastic.co/t/did-logstash-1-5-3-version-is-compatible-with-solaris-11-3-version/99352)
**Author:** [@yogeswararao](https://discuss.elastic.co/u/yogeswararao)\ **Replies:** 4\ **Last updated:** [September 11, 2017, 6:08am UTC](https://discuss.elastic.co/t/did-logstash-1-5-3-version-is-compatible-with-solaris-11-3-version/99352 "2017-09-11T06:08:47Z")
The logstash 1.5.3 version is working fine in the Solaris 10.x version. After OS version migrated to 11.3 we are not able to start the logstash service? which version of Logstah can be used on Solaris 11.3 - it has to… --- ## [Logstash throwing \_globbed\_files error while reading a file](https://discuss.elastic.co/t/logstash-throwing--globbed-files-error-while-reading-a-file/99470)
**Author:** [@rajesh](https://discuss.elastic.co/u/rajesh)\ **Replies:** 7\ **Last updated:** [September 11, 2017, 6:02am UTC](https://discuss.elastic.co/t/logstash-throwing--globbed-files-error-while-reading-a-file/99470 "2017-09-11T06:02:43Z")
Hi, I am trying to parse file in a directory(Linux) under /opt/\*. I am giving the exact file name and it’s throwing an error \_globbed\_files: /opt/my\_file\_2017-07-21\_03-10-46\_agg\_19303.out: glob is: \["/opt/my\_file\_2017-… --- ## [Grok Filter not being applied](https://discuss.elastic.co/t/grok-filter-not-being-applied/99895)
**Author:** [@Kevin\_Liang](https://discuss.elastic.co/u/Kevin_Liang)\ **Replies:** 1\ **Last updated:** [September 11, 2017, 3:47am UTC](https://discuss.elastic.co/t/grok-filter-not-being-applied/99895 "2017-09-11T03:47:23Z")
message: vspp\_manager1\_log 09/08/17 19:12:55.874 I SESSION 17126 @EGPHCAAAHLLOCLJF Session allocation request: streamer\_id 192.168.96.211, initiator /, stb\_id , s\_mode STATIC, device profile filter{ if \[message\] =~ "v… --- ## [Aggregate filter not working in logstash 5.4.2](https://discuss.elastic.co/t/aggregate-filter-not-working-in-logstash-5-4-2/99963)
**Author:** [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\ **Replies:** 1\ **Last updated:** [September 11, 2017, 3:37am UTC](https://discuss.elastic.co/t/aggregate-filter-not-working-in-logstash-5-4-2/99963 "2017-09-11T03:37:16Z")
Hi all, Aggregate filter not working in logstash 5.4.2. I used latest aggregate filter plugin and my config file as follows. input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin:@drssqlentrac\_sc.aaa-… --- ## [Aggregate filter not working](https://discuss.elastic.co/t/aggregate-filter-not-working/99962)
**Author:** [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\ **Replies:** 1\ **Last updated:** [September 11, 2017, 3:36am UTC](https://discuss.elastic.co/t/aggregate-filter-not-working/99962 "2017-09-11T03:36:23Z")
Hi MagnusBaeck, Aggregate filter not working. Seems susscessful message in trace but not working on storing output into mongodb. My Config file as, input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin:@drssql… --- ## [Logstash doesnt work with ECC/ECDSA](https://discuss.elastic.co/t/logstash-doesnt-work-with-ecc-ecdsa/99687)
**Author:** [@aubreybox](https://discuss.elastic.co/u/aubreybox)\ **Replies:** 2\ **Last updated:** [September 10, 2017, 4:45pm UTC](https://discuss.elastic.co/t/logstash-doesnt-work-with-ecc-ecdsa/99687 "2017-09-10T16:45:00Z")
Hello, I tried to setup logstash and filebeat over selfmade ssl certificates using an own rootca and an intermediate ca. The problem is: I cant connect to the running logstash curl: (35) gnutls\_handshake() failed: Han… --- ## [JDBC Input - New Events only](https://discuss.elastic.co/t/jdbc-input-new-events-only/99964)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 1\ **Last updated:** [September 10, 2017, 3:51pm UTC](https://discuss.elastic.co/t/jdbc-input-new-events-only/99964 "2017-09-10T15:51:55Z")
Hello, I am running ELK Stack - 5.4.1 with JDBC Input plugin to fetch data from an ORACLE database table My data does not have any unique ID Even the Timestamp (date\_and\_time) brings multiple events at same time. Hen… --- ## [Logstash5.5.0 Out of memory issue](https://discuss.elastic.co/t/logstash5-5-0-out-of-memory-issue/99934)
**Author:** [@Hoffin\_Ag](https://discuss.elastic.co/u/Hoffin_Ag)\ **Replies:** 2\ **Last updated:** [September 10, 2017, 3:27am UTC](https://discuss.elastic.co/t/logstash5-5-0-out-of-memory-issue/99934 "2017-09-10T03:27:34Z")
Hi, ELK is a great tool for advanced analytics on huge data. we are using ELK 5.5.0 version. When we run the logstash it is continuously crashing every minute on 1 gb of data import sample logstash.conf File input{ … --- ## [How do i drop headers in a log file? (grokparsefailure)](https://discuss.elastic.co/t/how-do-i-drop-headers-in-a-log-file-grokparsefailure/99910)
**Author:** [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)\ **Replies:** 1\ **Last updated:** [September 10, 2017, 1:12am UTC](https://discuss.elastic.co/t/how-do-i-drop-headers-in-a-log-file-grokparsefailure/99910 "2017-09-10T01:12:11Z")
So I finally got my config working and now i recieve grokparsefailure, and it is because filebeat is pushing the headers to logstash and it is not configured of course to filter for the headers. For example, my bro DNS … --- ## [Move the config file to QA for testing](https://discuss.elastic.co/t/move-the-config-file-to-qa-for-testing/99915)
**Author:** [@jagan](https://discuss.elastic.co/u/jagan)\ **Replies:** 1\ **Last updated:** [September 10, 2017, 12:50am UTC](https://discuss.elastic.co/t/move-the-config-file-to-qa-for-testing/99915 "2017-09-10T00:50:28Z")
HI All, Could you please suggest/guide me how to test the config files of logstash (say xy.config) and move it to QA for testing. Thanks, Jagan --- ## [How does sincedb work for a Logstash reading multiple files from a single directory?](https://discuss.elastic.co/t/how-does-sincedb-work-for-a-logstash-reading-multiple-files-from-a-single-directory/99456)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 5\ **Last updated:** [September 9, 2017, 11:36pm UTC](https://discuss.elastic.co/t/how-does-sincedb-work-for-a-logstash-reading-multiple-files-from-a-single-directory/99456 "2017-09-09T23:36:01Z")
Hi, I am wondering how sincedb file works for multiple files in a single directory. When I start Logstash and once it process all the files sincedb file has only one line(probably just the information of a single file).… --- ## [Replacing @timestamp with log timestamp](https://discuss.elastic.co/t/replacing-timestamp-with-log-timestamp/99354)
**Author:** [@scayzer65](https://discuss.elastic.co/u/scayzer65)\ **Replies:** 2\ **Last updated:** [September 9, 2017, 2:17am UTC](https://discuss.elastic.co/t/replacing-timestamp-with-log-timestamp/99354 "2017-09-09T02:17:24Z")
Hi I have a Windows FTP Server and the FTP application is producing real-time logs. I would like to replace the default @timestamp with the timestamp from the log. The message filter is working fine but when i add the d… --- ## [Logstash double quote escape](https://discuss.elastic.co/t/logstash-double-quote-escape/98089)
**Author:** [@Kevin\_Liang](https://discuss.elastic.co/u/Kevin_Liang)\ **Replies:** 4\ **Last updated:** [September 8, 2017, 8:07pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089 "2017-09-08T20:07:11Z")
I have a JSON message that is not escaping well due to a double quote after "\#\ **Author:** [@etfeet](https://discuss.elastic.co/u/etfeet)\ **Replies:** 0\ **Last updated:** [September 8, 2017, 7:16pm UTC](https://discuss.elastic.co/t/logstash-loging-stdout-output-to-syslog/99887 "2017-09-08T19:16:07Z") Hi, I just did a logstash 2.4 to 5.5 upgrade and when I try to debug my filters using the stdout output it sends all the logstash event messages to the system syslog. Is there a way to send it to a standalone logfile li… --- ## [Variable length csv](https://discuss.elastic.co/t/variable-length-csv/99867)
**Author:** [@Arun\_Kaliraja\_Baskar](https://discuss.elastic.co/u/Arun_Kaliraja_Baskar)\ **Replies:** 1\ **Last updated:** [September 8, 2017, 6:58pm UTC](https://discuss.elastic.co/t/variable-length-csv/99867 "2017-09-08T18:58:42Z")
Hi, I have a csv file where data is organised in the may formats: format1: value1, value2, value3,value4 format2: value1, value2, value3, keyX:valueX,keyY:valueY,keyZ:valueZ.. in the 2nd format my key:value will be o… --- ## [Daily indices into monthly](https://discuss.elastic.co/t/daily-indices-into-monthly/99777)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 4\ **Last updated:** [September 8, 2017, 6:31pm UTC](https://discuss.elastic.co/t/daily-indices-into-monthly/99777 "2017-09-08T18:31:10Z")
I read @warkolm post about moving daily indices into monthly and i thank him for the great example. ( Example ) I have couple hundred individual indexes which i managed to create the logstash.conf file using a ruby prog… --- ## [Dissect Filter Special Characters](https://discuss.elastic.co/t/dissect-filter-special-characters/98296)
**Author:** [@AO-StreetArt](https://discuss.elastic.co/u/AO-StreetArt)\ **Replies:** 6\ **Last updated:** [September 8, 2017, 5:25pm UTC](https://discuss.elastic.co/t/dissect-filter-special-characters/98296 "2017-09-08T17:25:52Z")
I am trying to use dissect to break apart a multi-line string which contains the characters ‘{’ and ‘}’ in what will be a delimiter. To do this, I would need to use escape characters (such as ‘\\n’) within the dissect fi… --- ## [Plugin install failed even with 'no-verify'](https://discuss.elastic.co/t/plugin-install-failed-even-with-no-verify/99869)
**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\ **Replies:** 1\ **Last updated:** [September 8, 2017, 4:42pm UTC](https://discuss.elastic.co/t/plugin-install-failed-even-with-no-verify/99869 "2017-09-08T16:42:59Z")
Not sure if I got the syntax right, but # bin/logstash-plugin install logstash-filter-tld ERROR: Something went wrong when installing logstash-filter-tld, message: certificate verify failed # bin/logstash-plugin insta… --- ## [Logstash 5.4.3 crash "interrupted waiting for mutex: null" in DNS resolver](https://discuss.elastic.co/t/logstash-5-4-3-crash-interrupted-waiting-for-mutex-null-in-dns-resolver/98858)
**Author:** [@Daniel314](https://discuss.elastic.co/u/Daniel314)\ **Replies:** 1\ **Last updated:** [September 8, 2017, 4:22pm UTC](https://discuss.elastic.co/t/logstash-5-4-3-crash-interrupted-waiting-for-mutex-null-in-dns-resolver/98858 "2017-09-08T16:22:53Z")
Hello, This is the second “interrupted” issue that I’ve encountered with Logstash 5.4.3 that causes it to crash (see other post for that issue. \[2017-08-30T04:12:41,881\]\[ERROR\]\[logstash.pipeline \] Exception in p… --- ## [Logstash ignores lines of a Logfile when file is moved or copied](https://discuss.elastic.co/t/logstash-ignores-lines-of-a-logfile-when-file-is-moved-or-copied/99863)
**Author:** [@TWalter](https://discuss.elastic.co/u/TWalter)\ **Replies:** 0\ **Last updated:** [September 8, 2017, 2:21pm UTC](https://discuss.elastic.co/t/logstash-ignores-lines-of-a-logfile-when-file-is-moved-or-copied/99863 "2017-09-08T14:21:05Z")
Hello there, i have the following problem with Logstash now. A internal service copies several logfiles from a source folder to the destination folder where logstash, where logstash listens via the input plugin. This … --- ## [Missing handlers on tomcat server](https://discuss.elastic.co/t/missing-handlers-on-tomcat-server/99843)
**Author:** [@Fonten](https://discuss.elastic.co/u/Fonten)\ **Replies:** 2\ **Last updated:** [September 8, 2017, 2:10pm UTC](https://discuss.elastic.co/t/missing-handlers-on-tomcat-server/99843 "2017-09-08T14:10:53Z")
Hello, i'm trying to parse some tomcat logs but i'm getting the following errors: io/console not supported; tty will not be manipulated Can't load log handler "1catalina.org.apache.juli.FileHandler" java.lang.ClassNotF… --- ## [Syslog output doesn't support dynamic host](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 3\ **Last updated:** [September 8, 2017, 1:24pm UTC](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257 "2017-09-08T13:24:58Z")
Hi, I have to route alerts from remote sites back to their syslog servers. For that, I parse the alert event and based on its’ value, I add metadata field: if \[\_source\]\[site\] == "new york" { mutate { add\_field =\> { "\[… --- ## [Logstash failed to output to Zabbix](https://discuss.elastic.co/t/logstash-failed-to-output-to-zabbix/99404)
**Author:** [@ayumequi](https://discuss.elastic.co/u/ayumequi)\ **Replies:** 1\ **Last updated:** [September 8, 2017, 1:12pm UTC](https://discuss.elastic.co/t/logstash-failed-to-output-to-zabbix/99404 "2017-09-08T13:12:50Z")
Hello, I’m trying to send keys/values from Logstash to Zabbix with logstash-output-zabbix and after trying different config options I stopped at this error “Zabbix server at \[…\] rejected all items sent.” if I use zabbi… --- ## [Logstash 6.0.0 Command Line error](https://discuss.elastic.co/t/logstash-6-0-0-command-line-error/98748)
**Author:** [@thomasdang](https://discuss.elastic.co/u/thomasdang)\ **Replies:** 6\ **Last updated:** [September 8, 2017, 1:09pm UTC](https://discuss.elastic.co/t/logstash-6-0-0-command-line-error/98748 "2017-09-08T13:09:18Z")
I’m testing out the Logstash 6.0.0 on Windows server 2012. Here’s the pipelines.yml (under directory C:\\logstash600\\config): - pipeline.id: winevents path.config: "C:/logstash600/pipelines/winevents.cfg" Here’s the f… --- ## [How can I receive path from another file in logstash?](https://discuss.elastic.co/t/how-can-i-receive-path-from-another-file-in-logstash/99789)
**Author:** [@Akrishna](https://discuss.elastic.co/u/Akrishna)\ **Replies:** 5\ **Last updated:** [September 8, 2017, 10:47am UTC](https://discuss.elastic.co/t/how-can-i-receive-path-from-another-file-in-logstash/99789 "2017-09-08T10:47:36Z")
example:- input { file { path =\>pipe{command =\> "cat /home/xyz/Logstash/logstash\_logstashconf/directories.csv"} } } ////////////////////// Content inside directories.csv ///////////////////////// \["/home/sys/logs… --- ## [Duplicate data parsed by Logstash, which cause duplicate data in Elasticsearch index](https://discuss.elastic.co/t/duplicate-data-parsed-by-logstash-which-cause-duplicate-data-in-elasticsearch-index/99531)
**Author:** [@sezanawa](https://discuss.elastic.co/u/sezanawa)\ **Replies:** 4\ **Last updated:** [September 8, 2017, 10:33am UTC](https://discuss.elastic.co/t/duplicate-data-parsed-by-logstash-which-cause-duplicate-data-in-elasticsearch-index/99531 "2017-09-08T10:33:13Z")
Hallo Eveybody I am using ELK for Log parsing. I have a Job which dowload Logfiles after every 15 mins to a central log directory. Logstash is configured to parse log files from central directory and send to ES. as i n… --- ## [Logstash to ES cluster](https://discuss.elastic.co/t/logstash-to-es-cluster/99830)
**Author:** [@soumya1](https://discuss.elastic.co/u/soumya1)\ **Replies:** 2\ **Last updated:** [September 8, 2017, 10:22am UTC](https://discuss.elastic.co/t/logstash-to-es-cluster/99830 "2017-09-08T10:22:28Z")
how should be the conf for Sending data to ES cluster (of 3 nodes) from Logstash should i give all the urls of the cluster in output as: output { elasticsearch { hosts =\> \["es-client-01:9200","es-master-01:9200","es-… --- ## [If condition, with csv filter not working](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283)
**Author:** [@vipinkumar](https://discuss.elastic.co/u/vipinkumar)\ **Replies:** 4\ **Last updated:** [September 8, 2017, 10:11am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283 "2017-09-08T10:11:02Z")
i am trying to apply ‘if’ condition on the bases of field which i have defined in filebeat.yml file, and inside ‘if’ condition i have placed a csv filter which is supposed to filter the data and those data should be d… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=910) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=912)